{
   "properties": {
      "displayName": "Apply Diagnostic Settings for Network Security Groups",
      "mode": "Indexed",
      "description": "This policy automatically deploys diagnostic settings to network security groups.",
      "metadata": {
         "category": "Monitoring"
      },
      "parameters": {
         "storagePrefix": {
            "type": "String",
            "metadata": {
               "displayName": "Storage Account Prefix for Regional Storage Account"
            }
         },
         "rgName": {
            "type": "String",
            "metadata": {
               "displayName": "Resource Group Name for Storage Account (must exist)",
               "description": "This resource group must already exist",
               "strongType": "ExistingResourceGroups"
            }
         }
      },
      "policyRule": {
         "if": {
            "field": "type",
            "equals": "Microsoft.Network/networkSecurityGroups"
         },
         "then": {
            "effect": "deployIfNotExists",
            "details": {
               "type": "Microsoft.Insights/diagnosticSettings",
               "name": "setbypolicy",
               "roleDefinitionIds": [
                  "/providers/Microsoft.Authorization/roleDefinitions/17d1049b-9a84-46fb-8f53-869881c3d3ab"
               ],
               "deployment": {
                  "properties": {
                     "mode": "incremental",
                     "template": {
                        "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                        "contentVersion": "1.0.0.0",
                        "parameters": {
                           "location": {
                              "type": "string"
                           },
                           "storagePrefix": {
                              "type": "string"
                           },
                           "nsgName": {
                              "type": "string"
                           },
                           "rgName": {
                              "type": "string"
                           }
                        },
                        "variables": {
                           "storageDeployName": "[concat('policyStorage_', uniqueString(parameters('location'), parameters('nsgName')))]"
                        },
                        "resources": [
                           {
                              "type": "Microsoft.Network/networkSecurityGroups/providers/diagnosticSettings",
                              "name": "[concat(parameters('nsgName'),'/Microsoft.Insights/setbypolicy')]",
                              "apiVersion": "2017-05-01-preview",
                              "location": "[parameters('location')]",
                              "dependsOn": [
                                 "[variables('storageDeployName')]"
                              ],
                              "properties": {
                                 "storageAccountId": "[reference(variables('storageDeployName')).outputs.storageAccountId.value]",
                                 "logs": [
                                    {
                                       "category": "NetworkSecurityGroupEvent",
                                       "enabled": true,
                                       "retentionPolicy": {
                                          "enabled": false,
                                          "days": 0
                                       }
                                    },
                                    {
                                       "category": "NetworkSecurityGroupRuleCounter",
                                       "enabled": true,
                                       "retentionPolicy": {
                                          "enabled": false,
                                          "days": 0
                                       }
                                    }
                                 ]
                              }
                           },
                           {
                              "apiVersion": "2017-05-10",
                              "name": "[variables('storageDeployName')]",
                              "type": "Microsoft.Resources/deployments",
                              "resourceGroup": "[parameters('rgName')]",
                              "properties": {
                                 "mode": "incremental",
                                 "parameters": {
                                    "location": {
                                       "value": "[parameters('location')]"
                                    },
                                    "storagePrefix": {
                                       "value": "[parameters('storagePrefix')]"
                                    }
                                 },
                                 "template": {
                                    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json",
                                    "contentVersion": "1.0.0.0",
                                    "parameters": {
                                       "location": {
                                          "type": "string"
                                       },
                                       "storagePrefix": {
                                          "type": "string"
                                       }
                                    },
                                    "resources": [
                                       {
                                          "apiVersion": "2017-06-01",
                                          "type": "Microsoft.Storage/storageAccounts",
                                          "name": "[concat(parameters('storageprefix'), parameters('location'))]",
                                          "sku": {
                                             "name": "Standard_LRS",
                                             "tier": "Standard"
                                          },
                                          "kind": "Storage",
                                          "location": "[parameters('location')]",
                                          "tags": {
                                             "created-by": "policy"
                                          },
                                          "scale": null,
                                          "properties": {
                                             "networkAcls": {
                                                "bypass": "AzureServices",
                                                "defaultAction": "Allow",
                                                "ipRules": [],
                                                "virtualNetworkRules": []
                                             },
                                             "supportsHttpsTrafficOnly": false
                                          }
                                       }
                                    ],
                                    "outputs": {
                                       "storageAccountId": {
                                          "type": "string",
                                          "value": "[resourceId(parameters('rgName'), 'Microsoft.Storage/storageAccounts', concat(parameters('storagePrefix'), parameters('location')))]"
                                       }
                                    }
                                 }
                              }
                           }
                        ]
                     },
                     "parameters": {
                        "location": {
                           "value": "[field('location')]"
                        },
                        "storagePrefix": {
                           "value": "[parameters('storagePrefix')]"
                        },
                        "rgName": {
                           "value": "[parameters('rgName')]"
                        },
                        "nsgName": {
                           "value": "[field('name')]"
                        }
                     }
                  }
               }
            }
         }
      }
   }
}