{
    "properties": {
        "displayName": "Audit Resource Locks on Resource Groups based on Tags",
        "description": "Audits all Resource Groups that have a specific Tag, for the CanNotDelete Resource Lock.",
        "mode": "All",
        "parameters": {
            "tagName": {
              "type": "String",
              "metadata": {
                "displayName": "Tag Name",
                "description": "The Tag name to audit against (i.e. Environment, CostCenter, etc.)"
              }
            },
            "tagValue": {
              "type": "String",
              "metadata": {
                "displayName": "Tag Value",
                "description": "Value of the tag to audit against (i.e. Prod/UAT/TEST, 12345, etc.)"
              }
            }
        },
        "policyRule": {
            "if": {
                "allOf": [
                    {
                        "field": "type",
                        "equals": "Microsoft.Resources/subscriptions/resourceGroups"
                    },
                    {
                        "field": "[concat('tags[', parameters('tagName'), ']')]",
                        "equals": "[parameters('tagValue')]"
                    }
                ]
            },
            "then": {
                "effect": "auditIfNotExists",
                "details": {
                    "type": "Microsoft.Authorization/locks",
                    "existenceCondition": {
                        "field": "Microsoft.Authorization/locks/level",
                        "equals": "CanNotDelete"
                    }
                }
            }
        }
    }
}