NSG blocks inbound SSH (TCP port 22) from the Internet

# Restrict SSH to a specific source so port 22 is not open to the Internet
resource "azurerm_network_security_rule" "<example_resource_name>" {
  name                        = "<example_rule_name>"
  resource_group_name         = "<example_resource_name>"
  network_security_group_name = "<example_resource_name>"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "22"
  source_address_prefix       = "<ALLOWED_CIDR>" # CRITICAL: restrict SSH source; not Internet/*/0.0.0.0/0
  destination_address_prefix  = "*"
}

// NSG allowing SSH only from a specific source (not the Internet)
resource <example_resource_name> 'Microsoft.Network/networkSecurityGroups@2023-09-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  properties: {
    securityRules: [
      {
        name: '<example_rule_name>'
        properties: {
          priority: 100
          direction: 'Inbound'
          access: 'Allow'
          protocol: 'Tcp'
          sourcePortRange: '*'
          destinationPortRange: '22'
          sourceAddressPrefix: '<ALLOWED_CIDR>' // CRITICAL: restrict SSH source; not Internet/*/0.0.0.0/0
          destinationAddressPrefix: '*'
        }
      }
    ]
  }
}