How do I restrict inbound SSH traffic to a Virtual Machine?

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure-native";

// Create an Azure Resource Group
const resourceGroup = new azure.resources.ResourceGroup("resourceGroup", {
    location: "WestUS",
});

// Create a Virtual Network
const virtualNetwork = new azure.network.VirtualNetwork("virtualNetwork", {
    resourceGroupName: resourceGroup.name,
    location: resourceGroup.location,
    addressSpace: { addressPrefixes: ["10.0.0.0/16"] },
});

// Create a Subnet
const subnet = new azure.network.Subnet("subnet", {
    resourceGroupName: resourceGroup.name,
    virtualNetworkName: virtualNetwork.name,
    addressPrefix: "10.0.1.0/24",
});

// Create a Network Security Group
const networkSecurityGroup = new azure.network.NetworkSecurityGroup("networkSecurityGroup", {
    resourceGroupName: resourceGroup.name,
    location: resourceGroup.location,
    securityRules: [{
        name: "AllowSSH",
        priority: 1000,
        direction: "Inbound",
        access: "Allow",
        protocol: "Tcp",
        sourcePortRange: "*",
        destinationPortRange: "22",
        sourceAddressPrefix: "203.0.113.0/24", // Replace with your IP range
        destinationAddressPrefix: "*",
    }],
});

// Create a Public IP
const publicIp = new azure.network.PublicIPAddress("publicIp", {
    resourceGroupName: resourceGroup.name,
    location: resourceGroup.location,
    publicIPAllocationMethod: "Dynamic",
});

// Create a Network Interface
const networkInterface = new azure.network.NetworkInterface("networkInterface", {
    resourceGroupName: resourceGroup.name,
    location: resourceGroup.location,
    ipConfigurations: [{
        name: "ipConfig",
        subnet: { id: subnet.id },
        privateIPAllocationMethod: "Dynamic",
        publicIPAddress: { id: publicIp.id },
    }],
    networkSecurityGroup: { id: networkSecurityGroup.id },
});

// Create a Virtual Machine
const vm = new azure.compute.VirtualMachine("virtualMachine", {
    resourceGroupName: resourceGroup.name,
    location: resourceGroup.location,
    networkProfile: {
        networkInterfaces: [{ id: networkInterface.id }],
    },
    hardwareProfile: {
        vmSize: "Standard_B1s",
    },
    osProfile: {
        computerName: "hostname",
        adminUsername: "adminuser",
        adminPassword: "Password1234!",
    },
    storageProfile: {
        imageReference: {
            publisher: "Canonical",
            offer: "UbuntuServer",
            sku: "18.04-LTS",
            version: "latest",
        },
        osDisk: {
            createOption: "FromImage",
        },
    },
});