{
   "properties": {
      "displayName": "Audit SQL Server virtual network rule",
      "description": "Audits the existence of a rule that enables traffic from a SQL Server to a specific subnet.",
      "parameters": {
         "subnetId": {
            "type": "string",
            "metadata": {
               "displayName": "Subnet ID",
               "description": "The resource ID of the virtual network subnet that should have a rule enabled. Example: /subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Default/providers/Microsoft.Network/virtualNetworks/testvnet/subnets/testsubnet"
            }
         }
      },
      "policyRule": {
         "if": {
            "field": "type",
            "equals": "Microsoft.Sql/servers"
         },
         "then": {
            "effect": "AuditIfNotExists",
            "details": {
               "type": "Microsoft.Sql/servers/virtualNetworkRules",
               "existenceCondition": {
                  "field": "Microsoft.Sql/servers/virtualNetworkRules/virtualNetworkSubnetId",
                  "equals": "[parameters('subnetId')]"
               }
            }
         }
      }
   }
}