NSG blocks inbound HTTP (port 80) from the Internet

# Deny inbound HTTP from Internet on an existing NSG
resource "azurerm_network_security_rule" "deny_http_internet" {
  name                        = "deny-http-internet"
  resource_group_name         = "<example_resource_name>"
  network_security_group_name = "<example_resource_name>"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Deny"           # CRITICAL: Deny so HTTP from Internet is not allowed
  protocol                    = "Tcp"
  source_address_prefix       = "Internet"       # CRITICAL: Matches traffic from the Internet
  destination_address_prefix  = "*"
  source_port_range           = "*"
  destination_port_range      = "80"             # CRITICAL: Blocks port 80 (HTTP)
}

// Deny inbound HTTP from Internet on an existing NSG
resource nsg 'Microsoft.Network/networkSecurityGroups@2023-09-01' existing = {
  name: '<example_resource_name>'
}

resource denyHttp 'Microsoft.Network/networkSecurityGroups/securityRules@2023-09-01' = {
  name: '${nsg.name}/Deny-HTTP-Internet'
  properties: {
    priority: 100
    direction: 'Inbound'
    access: 'Deny'                 // CRITICAL: Denies the HTTP rule so it no longer allows Internet traffic
    protocol: 'Tcp'
    sourceAddressPrefix: 'Internet' // CRITICAL: Targets traffic coming from the Internet
    destinationAddressPrefix: '*'
    sourcePortRange: '*'
    destinationPortRange: '80'      // CRITICAL: Blocks port 80 (HTTP)
  }
}