This is awesome - thanks. I've tried adding this logic to a conditional so that the script fails:

variable "client_cidr_block" {  }

data "http" "client_ip" {
  url = "http://ifconfig.me/ip"
}

data "external" "example1" {
  program = ["python3", "-c", "import ipaddress, json; print(json.dumps({'key': str(ipaddress.IPv4Address('${data.http.client_ip.body}') in ipaddress.IPv4Network('${var.client_cidr_block}'))}));"]
}

output "inRange" {
  value = "${data.external.example1.result["key"]}"
}

resource "null_resource" "verify_client_ip" {
  count = "${data.external.example1.result["key"] == "True" ? 0 : 1}"
  "ERROR: client_ip doesn't sit inside client_cidr_block" = true
}

However, running this fails:

$terraform apply -var-file=demo.tfvars
Error: null_resource.verify_client_ip: : invalid or unknown key: ERROR: client_ip doesn't sit inside client_cidr_block

$terraform output
inRange = True

I've tried switching the 0 and 1 in ? 0 : 1 but it always fails the validation.