Network rule collection deleted when updating tags on firewall hashicorp/terraform-provider-azurerm#2621

inputs.tf

variable "tags" {
  description = "A map of tag values for all Azure resources capable of being tagged."
  type        = "map"
}

locals.tf

locals {
  location = "UK South"
  name     = "AzureRMProvider-FirewallIssue"
}

resource.firewall.tf

resource "azurerm_firewall" "main" {
  name = "${local.name}"

  location            = "${azurerm_resource_group.main.location}"
  resource_group_name = "${azurerm_resource_group.main.name}"
  tags                = "${var.tags}"

  ip_configuration {
    internal_public_ip_address_id = "${azurerm_public_ip.main.id}"
    name                          = "${azurerm_public_ip.main.name}"
    subnet_id                     = "${azurerm_subnet.main.id}"
  }
}

resource.network_rule_collection.tf

resource "azurerm_firewall_network_rule_collection" "AllowAllOutbound" {
  name = "${azurerm_firewall.main.name}-AllowAllOutbound"

  azure_firewall_name = "${azurerm_firewall.main.name}"
  resource_group_name = "${azurerm_resource_group.main.name}"

  action   = "Allow"
  priority = 999

  rule {
    name = "AllowAllOutbound"

    destination_addresses = [
      "0.0.0.0/0",
    ]

    source_addresses = [
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
    ]

    destination_ports = ["*"]

    protocols = ["Any"]
  }
}

resource.public_ip.tf

resource "azurerm_public_ip" "main" {
  name = "${local.name}"

  ip_version                   = "IPv4"
  location                     = "${azurerm_resource_group.main.location}"
  public_ip_address_allocation = "Static"
  resource_group_name          = "${azurerm_resource_group.main.name}"
  sku                          = "Standard"
  tags                         = "${var.tags}"
}

resource.rg.tf

resource "azurerm_resource_group" "main" {
  name = "${local.name}"

  location = "${local.location}"
  tags     = "${var.tags}"
}

resource.subnet.tf

resource "azurerm_subnet" "main" {
  name = "AzureFirewallSubnet"

  address_prefix       = "10.0.0.0/16"
  resource_group_name  = "${azurerm_resource_group.main.name}"
  virtual_network_name = "${azurerm_virtual_network.main.name}"
}

resource.vnet.tf

resource "azurerm_virtual_network" "main" {
  name = "${local.name}"

  location            = "${local.location}"
  resource_group_name = "${azurerm_resource_group.main.name}"
  tags                = "${var.tags}"

  address_space = ["10.0.0.0/8"]
}

terraform.tfvars

tags = {
  foo    = "bar"
  baz    = "qux"
  quux   = "corge"
  uier   = "grault"
  garply = "waldo"
  fred   = "plugh"
  thud   = "mos"
  henk   = "def"
}