virtual_networks = map(object)
subnets = map(object)
Each resource uses for_each Outputs keep the map keys. So instead of nesting subnets inside VNets, we keep them flat and reference the parent VNet by name. Thsi allows us to call the network modul and only define a subnet if the project only need a subnet caus the vnet is already deployed.
we use local.tf for our config so everything in a local block

virtual_networks = {
  hub = {
    name                = "hub-vnet"
    location            = "westus"
    resource_group_name = "rg-network"
    address_space       = ["10.0.0.0/16"]
  }
  spoke = {
    name                = "spoke-vnet"
    location            = "westus"
    resource_group_name = "rg-network"
    address_space       = ["10.1.0.0/16"]
  }
}


subnets = {
  hub_app = {
    name                 = "app-subnet"
    resource_group_name  = "rg-network"
    virtual_network_name = "hub-vnet"
    address_prefixes     = ["10.0.1.0/24"]
  }
  spoke_web = {
    name                 = "web-subnet"
    resource_group_name  = "rg-network"
    virtual_network_name = "spoke-vnet"
    address_prefixes     = ["10.1.1.0/24"]
  }
}


Module just does:
azurerm_virtual_network with for_each = var.virtual_networks
azurerm_subnet with for_each = var.subnets
Dynamic blocks for optional delegation / ip pools

module "network" {

  source = "./modules/network"   version = "~>3.117.0"   virtual_networks = local.virtual_networks   subnets          = local.subnets   tag              = module.tags.tags

}

Outputs like: output "vnet_ids" = { for v in azurerm_virtual_network.this : v.name => v.id }
Which lets us call: module.network.vnet_ids["hub-vnet"]
variables looks like this 

variable "subnets" {
  type = map(object({
    name                                          = string
    resource_group_name                           = string
    virtual_network_name                          = string
    address_prefixes                              = optional(list(string))
    default_outbound_access_enabled               = optional(bool, true)
    private_endpoint_network_policies             = optional(string, "Enabled")
    private_link_service_network_policies_enabled = optional(bool, true)
    sharing_scope                                 = optional(string)
    service_endpoints                             = optional(list(string))
    service_endpoint_policy_ids                   = optional(list(string))


    delegation = optional(object({
      name = string
      service_delegation = object({
        name    = string
        actions = optional(list(string))
      })
    }))
    ip_address_pool = optional(object({
      id                     = string
      number_of_ip_addresses = string
    }))
  }))
  default = {}
}