Add virtual network flow logs quickstart

[halkazwini]

Summary

• add a Terraform quickstart that enables flow logs for an existing virtual network
• reference the existing regional Network Watcher instance and create a dedicated StorageV2 account
• expose configurable retention, flow log version, and storage replication settings
• document prerequisites, variables, and deployment commands

Validation

• terraform fmt -check
• terraform init -backend=false
• terraform validate with AzureRM 5.0.1

[stemaMSFT]

The overall shape looks good: reusing the regional Network Watcher and creating a dedicated storage account keeps the quickstart focused and avoids lifecycle-rule conflicts with a shared account.

There is one issue I think needs to be addressed before merge:

• retention_days defaults to 0 and is documented as retaining data indefinitely, but the resource always emits retention_policy { enabled = true, days = 0 }. Please encode the intended semantics explicitly, for example with enabled = var.retention_days > 0, or remove the zero/indefinite contract. As written, the default path relies on undocumented provider/API handling and may fail at apply.

Two documentation improvements would also make the lifecycle behavior clearer:

• Explain that the storage account is intentionally dedicated because the flow-log resource manages and may overwrite its lifecycle rules.
• Note that retention_days = 0 allows logs to accumulate until deletion, and that terraform destroy deletes the dedicated account and its stored logs.

The East US defaults and lack of cross-region prevalidation seem like usability concerns rather than blockers.

[halkazwini]

Thanks @stemaMSFT! I addressed the retention behavior and documentation feedback:

• Updated the retention policy to use enabled = var.retention_days > 0, so the default retention_days = 0 no longer relies on ambiguous provider/API behavior.
• Clarified that 0 disables automatic deletion based on age while flow logs continue to accumulate in storage.
• Documented why the template creates a dedicated storage account and that the flow-log resource might overwrite its lifecycle rules.
• Documented that terraform destroy deletes the flow-log resource, dedicated storage account, and stored logs.
• Added guidance for selecting a regional Network Watcher outside East US.

The pre-PR check and CLA check pass. The latest E2E check is waiting on the repository environment. Would you please take another look when you have a chance?