Existing Network Security Groups can be added to subnets in the same Resource Group, or new ones can be added in the Network Security Groups console and then associated. To associate an existing Network Security Group to an existing subnet, follow the steps below. For more information on how to create Network Security Groups to meet your organizational needs, see the Azure documentation.

In Azure Console -
From the Network Security Group:

Open the Azure Portal and go to Network Security Groups.
Select the Network Security Group you wish to add to a subnet.
Under Settings, select Subnets.
Select the Associate button.
Search for the virtual network and subnet.
Apply.

From the subnet:

Open the Azure Portal and go to Virtual Networks.
Select the Virtual Network you wish to edit.
Under Settings, select Subnets.
Select the subnet you wish to edit.
In the Network Security Group drop down, select the security group.
Save.

In Terraform -

For each azurerm_virtual_network resource, create a subnet block with a security_group identified by ID.
Alternatively, create an azurerm_subnet_network_security_group_association to link an azurerm_network_security_group resource.

References:
https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-restrict-network-access-to-resources#create-a-virtual-network
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network#security_group
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet_network_security_group_association

ID	Name	CSP	Domain	Severity
AC_AZURE_0356	Ensure every subnet block is configured with a Network Security Group in Azure Virtual Network	Azure	Infrastructure Security	MEDIUM
AC_AZURE_0256	Ensure private DNS zones are not linked to Azure Virtual Network	Azure	Compliance Validation	LOW
AC_AZURE_0355	Ensure DDoS protection standard is enabled for Azure Virtual Network	Azure	Infrastructure Security	MEDIUM

Detections

Analytics

Tenable Cloud Security Policies Search

MEDIUM

LOW

MEDIUM