Conditionally create nsg security rule | Parametrise source IP ranges

main.tf

@@ -171,16 +171,17 @@ resource "azurerm_network_security_group" "vm" {
 }
 
 resource "azurerm_network_security_rule" "vm" {
+  count                       = var.remote_port != "" ? 1 : 0
   name                        = "allow_remote_${coalesce(var.remote_port, module.os.calculated_remote_port)}_in_all"
   resource_group_name         = data.azurerm_resource_group.vm.name
   description                 = "Allow remote protocol in from all locations"
-  priority                    = 100
+  priority                    = 101
   direction                   = "Inbound"
   access                      = "Allow"
   protocol                    = "Tcp"
   source_port_range           = "*"
   destination_port_range      = coalesce(var.remote_port, module.os.calculated_remote_port)
-  source_address_prefix       = "*"
+  source_address_prefixes     = var.source_address_prefixes
   destination_address_prefix  = "*"
   network_security_group_name = azurerm_network_security_group.vm.name
 }
@@ -206,4 +207,4 @@ resource "azurerm_network_interface_security_group_association" "test" {
   count                     = var.nb_instances
   network_interface_id      = azurerm_network_interface.vm[count.index].id
   network_security_group_id = azurerm_network_security_group.vm.id
-}
+}

variables.tf

@@ -159,3 +159,8 @@ variable "nb_data_disk" {
   description = "(Optional) Number of the data disks attached to each virtual machine."
   default     = 0
 }
+
+variable "source_address_prefixes" {
+  description = "(Optional) List of source address prefixes allowed to access var.remote_port."
+  default     = ["*"]
+}