1. Log in to the Azure portal (https://portal.azure.com/).
2. Navigate to the resource group that contains the resources you want to secure.
3. Select the Virtual Network that you want to secure.
4. Click on the “Firewalls and virtual networks” tab.
5. Under the “Firewalls and virtual networks” tab, select “Selected networks” to restrict access to the virtual network.
6. Under the “Selected networks” option, select “Add existing virtual network”.
7. Select the virtual network that you want to allow access to and click “Add”.
8. Under the “Firewalls and virtual networks” tab, select “Selected IP addresses” to restrict access to specific IP addresses.
9. Under the “Selected IP addresses” option, select “Add IP address range”.
10. Enter the IP address range that you want to allow access to and click “Add”.
11. Click “Save” to apply the changes.

​

1. Open the Azure CLI and login to your account using the command:
   az login
   
2. Once you have successfully logged in, set the scope to the subscription level using the command:
   az account set --subscription <subscription-id>
   
   Replace <subscription-id> with the ID of the subscription you want to work with.
3. Next, create a Network Security Group (NSG) using the command:
   az network nsg create --name <nsg-name> --resource-group <resource-group-name>
   
   Replace <nsg-name> with a unique name for the NSG and <resource-group-name> with the name of the resource group where you want to create the NSG.
4. Once the NSG is created, you can define inbound and outbound rules to restrict network access. For example, you can create a rule to allow traffic only from a specific IP address using the command:
   az network nsg rule create --name <rule-name> --nsg-name <nsg-name> --resource-group <resource-group-name> --priority 100 --source-address-prefixes <ip-address> --destination-port-ranges '*'
   
   Replace <rule-name> with a unique name for the rule, <nsg-name> with the name of the NSG you created in step 3, <resource-group-name> with the name of the resource group where the NSG is located, and <ip-address> with the IP address you want to allow traffic from. You can also create additional rules to allow traffic for specific ports and protocols.
5. Finally, associate the NSG with the appropriate subnet or network interface using the command:
   az network vnet subnet update --name <subnet-name> --vnet-name <vnet-name> --resource-group <resource-group-name> --network-security-group <nsg-name>
   
   Replace <subnet-name> with the name of the subnet you want to associate the NSG with, <vnet-name> with the name of the virtual network where the subnet is located, <resource-group-name> with the name of the resource group where the virtual network is located, and <nsg-name> with the name of the NSG you created in step 3.

1. Import the required libraries:

from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient
from azure.mgmt.network.models import NetworkSecurityGroup

2. Authenticate to Azure using DefaultAzureCredential:

credential = DefaultAzureCredential()
network_client = NetworkManagementClient(credential, subscription_id)

3. Get the Network Security Group (NSG) resource:

nsg_name = "nsg_name"
nsg_resource_group = "nsg_resource_group"
nsg = network_client.network_security_groups.get(nsg_resource_group, nsg_name)

4. Update the NSG rules to restrict default network access:

# Remove the default allow-all inbound rule
for rule in nsg.security_rules:
    if rule.name == "AllowVnetInBound":
        nsg.security_rules.remove(rule)

# Add a new rule to allow only necessary traffic
nsg.security_rules.append(
    {
        "name": "AllowNecessaryTraffic",
        "protocol": "*",
        "source_address_prefix": "*",
        "destination_address_prefix": "*",
        "access": "Allow",
        "direction": "Inbound",
        "priority": 100,
        "source_port_range": "*",
        "destination_port_range": "80,443",
    }
)

# Update the NSG
network_client.network_security_groups.begin_create_or_update(nsg_resource_group, nsg_name, nsg)

resource "azurerm_key_vault" "this" {
  name                = "KEY_VAULT_NAME"
  resource_group_name = azurerm_resource_group.RG_NAME.name
  location            = azurerm_resource_group.RG_NAME.location
  tenant_id           = "TENANT_ID"
  sku_name            = "standard"

  # ...other required settings (access policies, RBAC, etc.)...

  network_acls {
    # Restrict default network access
    default_action = "Deny"

    # Optional: still allow trusted Azure services to reach the vault
    # Set to "None" if you want to deny *all* except explicit IPs/VNets.
    bypass = "AzureServices"

    # Optionally allow specific IPs
    # ip_rules = ["ALLOWED_PUBLIC_IP_CIDR"]

    # Optionally allow specific VNets/subnets
    # virtual_network_subnet_ids = [
    #   azurerm_subnet.ALLOWED_SUBNET.id,
    # ]
  }
}

• KEY_VAULT_NAME with your Key Vault name.
• RG_NAME with the Terraform name of your resource group.
• TENANT_ID with your Azure AD tenant ID.
• Optionally ALLOWED_PUBLIC_IP_CIDR and ALLOWED_SUBNET with your allowed sources.