Network Security Group Rule Diffing

# module.network.azurerm_network_security_group.app must be replaced
-/+ resource "azurerm_network_security_group" "app" {
      name                = "nsg-app"
      # (2 unchanged attributes hidden)

    - security_rule {
        - access                     = "Allow" -> null
        - destination_address_prefix = "*" -> null
        - destination_port_range     = "80" -> null
        - direction                  = "Inbound" -> null
        - name                       = "allow-http" -> null
        - priority                   = 100 -> null
        - protocol                   = "Tcp" -> null
        - source_address_prefix      = "*" -> null
        - source_port_range          = "*" -> null
      }
    + security_rule {
        + access                     = "Allow"
        + destination_address_prefix = "*"
        + destination_port_range     = "443"
        + direction                  = "Inbound"
        + name                       = "allow-https"
        + priority                   = 100
        + protocol                   = "Tcp"
        + source_address_prefix      = "*"
        + source_port_range          = "*"
      }
    + security_rule {
        + access                     = "Deny"
        + description                = "Block RDP from internet"
        + destination_address_prefix = "*"
        + destination_port_range     = "3389"
        + direction                  = "Inbound"
        + name                       = "deny-rdp"
        + priority                   = 200
        + protocol                   = "Tcp"
        + source_address_prefix      = "*"
        + source_port_range          = "*"
      }
    + security_rule {
        + access                     = "Allow"
        + description                = "Allow outbound HTTPS"
        + destination_address_prefix = "*"
        + destination_port_range     = "443"
        + direction                  = "Outbound"
        + name                       = "allow-outbound-https"
        + priority                   = 300
        + protocol                   = "Tcp"
        + source_address_prefix      = "*"
        + source_port_range          = "*"
      }
  }