Establish connection to a VNET via an ExpressRoute circuit

{"apiversion": "2020-05-01", "type": "microsoft.network/publicipaddresses", "name": "[variables('appgatewaypubipname')]", "location": "[parameters('location')]", "properties": {"publicipallocationmethod": "[parameters('publicipaddresstype')]"}}{"apiversion": "2020-05-01", "type": "microsoft.network/publicipaddresses", "name": "[concat(parameters('appserverspublicipprefix'), copyindex())]", "location": "[parameters('location')]", "copy": {"name": "foo", "count": "[variables('appscalecount')]"}, "properties": {"publicipallocationmethod": "[parameters('publicipaddresstype')]"}}{"apiversion": "2020-05-01", "type": "microsoft.network/virtualnetworks", "name": "[variables('vnetname')]", "location": "[parameters('location')]", "dependson": ["[resourceid('microsoft.network/networksecuritygroups/", variables('fensgname'))]", "[resourceid('microsoft.network/networksecuritygroups/", variables('appnsgname'))]", "[resourceid('microsoft.network/networksecuritygroups/", variables('bensgname'))]"], "properties": {"addressspace": {"addressprefixes": ["[variables('vnetaddressprefix')]"]}, "subnets": [{"name": "[variables('fesubnetname')]", "properties": {"addressprefix": "[variables('frontendprefix')]", "networksecuritygroup": {"id": "[resourceid('microsoft.network/networksecuritygroups", variables('fensgname'))]"}}}, {"name": "[variables('appsubnetname')]", "properties": {"addressprefix": "[variables('appprefix')]", "networksecuritygroup": {"id": "[resourceid('microsoft.network/networksecuritygroups", variables('appnsgname'))]"}}}, {"name": "[variables('besubnetname')]", "properties": {"addressprefix": "[variables('backendprefix')]", "networksecuritygroup": {"id": "[resourceid('microsoft.network/networksecuritygroups", variables('bensgname'))]"}}}]}}{"apiversion": "2020-05-01", "type": "microsoft.network/networksecuritygroups", "name": "[variables('fensgname')]", "location": "[parameters('location')]", "properties": {"securityrules": [{"name": "rdp_rule", "properties": {"description": "allow rdp", "protocol": "tcp", "sourceportrange": "*", "destinationportrange": "3389", "sourceaddressprefix": "internet", "destinationaddressprefix": "*", "access": "allow", "priority": 100, "direction": "inbound"}}, {"name": "web_rule", "properties": {"description": "allow website", "protocol": "tcp", "sourceportrange": "*", "destinationportrange": "80", "sourceaddressprefix": "internet", "destinationaddressprefix": "*", "access": "allow", "priority": 200, "direction": "inbound"}}, {"name": "app_subnet_rule", "properties": {"description": "outbound to app", "protocol": "tcp", "sourceportrange": "*", "destinationportrange": "*", "sourceaddressprefix": "*", "destinationaddressprefix": "[variables('appprefix')]", "access": "allow", "priority": 1000, "direction": "outbound"}}, {"name": "block_internal_network", "properties": {"description": "outbound to internal network", "protocol": "*", "sourceportrange": "*", "destinationportrange": "*", "sourceaddressprefix": "*", "destinationaddressprefix": "virtualnetwork", "access": "deny", "priority": 2000, "direction": "outbound"}}]}}{"apiversion": "2020-05-01", "type": "microsoft.network/networksecuritygroups", "name": "[variables('appnsgname')]", "location": "[parameters('location')]", "properties": {"securityrules": [{"name": "fe_rule", "properties": {"description": "allow frontend", "protocol": "tcp", "sourceportrange": "*", "destinationportrange": "*", "sourceaddressprefix": "[variables('frontendprefix')]", "destinationaddressprefix": "*", "access": "allow", "priority": 100, "direction": "inbound"}}, {"name": "rdp_rule", "properties": {"description": "allow rdp", "protocol": "tcp", "sourceportrange": "*", "destinationportrange": "3389", "sourceaddressprefix": "internet", "destinationaddressprefix": "*", "access": "allow", "priority": 200, "direction": "inbound"}}, {"name": "vnet_rule", "properties": {"description": "block internal network", "protocol": "*", "sourceportrange": "*", "destinationportrange": "*", "sourceaddressprefix": "virtualnetwork", "destinationaddressprefix": "*", "access": "deny", "priority": 300, "direction": "inbound"}}, {"name": "db_outbound_rule", "properties": {"description": "allow outbound db", "protocol": "*", "sourceportrange": "*", "destinationportrange": "*", "sourceaddressprefix": "*", "destinationaddressprefix": "[variables('backendprefix')]", "access": "allow", "priority": 1000, "direction": "outbound"}}, {"name": "deny_internet", "properties": {"description": "deny_internet", "protocol": "*", "sourceportrange": "*", "destinationportrange": "*", "sourceaddressprefix": "*", "destinationaddressprefix": "internet", "access": "deny", "priority": 2000, "direction": "outbound"}}]}}{"apiversion": "2020-05-01", "type": "microsoft.network/networksecuritygroups", "name": "[variables('bensgname')]", "location": "[parameters('location')]", "properties": {"securityrules": [{"name": "app_rule", "properties": {"description": "allow app servers", "protocol": "tcp", "sourceportrange": "*", "destinationportrange": "*", "sourceaddressprefix": "[variables('appprefix')]", "destinationaddressprefix": "*", "access": "allow", "priority": 100, "direction": "inbound"}}, {"name": "vnet_rule", "properties": {"description": "block internal network", "protocol": "*", "sourceportrange": "*", "destinationportrange": "*", "sourceaddressprefix": "virtualnetwork", "destinationaddressprefix": "*", "access": "deny", "priority": 200, "direction": "inbound"}}, {"name": "deny_internet", "properties": {"description": "deny_internet", "protocol": "*", "sourceportrange": "*", "destinationportrange": "*", "sourceaddressprefix": "*", "destinationaddressprefix": "internet", "access": "deny", "priority": 1000, "direction": "outbound"}}]}}