NSG blocks inbound RDP (TCP 3389) from the Internet

# NSG with RDP allowed only from a restricted CIDR (not Internet)
resource "azurerm_network_security_group" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<region>"
  resource_group_name = "<example_resource_name>"

  security_rule {
    name                       = "Allow-RDP-Restricted"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "3389"
    destination_address_prefix = "*"
    source_address_prefix      = "<AUTHORIZED_CIDR>" # CRITICAL: restrict source; not "*", "Internet", or "0.0.0.0/0" so the check passes
  }
}

// NSG with RDP allowed only from a restricted CIDR (not Internet)
resource nsg 'Microsoft.Network/networkSecurityGroups@2023-09-01' = {
  name: '<example_resource_name>'
  location: '<region>'
  properties: {
    securityRules: [
      {
        name: 'Allow-RDP-Restricted'
        properties: {
          priority: 100
          direction: 'Inbound'
          access: 'Allow'
          protocol: 'Tcp'
          sourcePortRange: '*'
          destinationPortRange: '3389'
          destinationAddressPrefix: '*'
          sourceAddressPrefix: '<AUTHORIZED_CIDR>' // CRITICAL: restrict source; not "Internet", "*", or "0.0.0.0/0" to pass the check
        }
      }
    ]
  }
}