{
  "properties": {
    "displayName": "Configure network security groups to use specific workspace for traffic analytics",
    "description": "If it already has traffic analytics enabled, then policy will overwrite its existing settings with the ones provided during policy creation. Traffic analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks.",
    "policyType": "BuiltIn",
    "mode": "Indexed",
    "metadata": {
      "version": "1.0.0",
      "category": "Network"
    },
    "parameters": {
      "effect": {
        "type": "string",
        "defaultValue": "DeployIfNotExists",
        "allowedValues": [
          "DeployIfNotExists",
          "Disabled"
        ],
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        }
      },
      "nsgRegion": {
        "type": "String",
        "metadata": {
          "displayName": "Network security group Region",
          "description": "Configures for network security groups in the selected region only.",
          "strongType": "location"
        }
      },
      "storageId": {
        "type": "String",
        "metadata": {
          "displayName": "Storage Resource ID",
          "description": "Resource ID of the storage account where the flow logs are written. Make sure this storage account is located in the selected network security group region. The format must be: '/subscriptions/{subscription id}/resourceGroups/{resourceGroup name}/providers/Microsoft.Storage/storageAccounts/{storage account name}",
          "assignPermissions": "true"
        }
      },
      "timeInterval": {
        "type": "String",
        "metadata": {
          "displayName": "Traffic analytics processing interval in minutes",
          "description": "Traffic analytics processes blobs at the selected frequency."
        },
        "defaultValue": "60",
        "allowedValues": [
          "10",
          "60"
        ]
      },
      "workspaceResourceId": {
        "type": "String",
        "metadata": {
          "displayName": "Workspace resource ID",
          "description": "Log Analytics workspace resource id",
          "assignPermissions": "true"
        }
      },
      "workspaceRegion": {
        "type": "String",
        "metadata": {
          "displayName": "Workspace region",
          "description": "Log Analytics workspace region",
          "strongType": "location"
        }
      },
      "workspaceId": {
        "type": "String",
        "metadata": {
          "displayName": "Workspace ID",
          "description": "Log Analytics workspace GUID"
        }
      },
      "networkWatcherRG": {
        "type": "String",
        "metadata": {
          "displayName": "Network Watcher resource group",
          "description": "The Network Watcher regional instance is present in this resource group. The network security group flow logs resources are also created. This is used only if a deployment is required. By default, it is named 'NetworkWatcherRG'.",
          "strongType": "existingResourceGroups"
        }
      },
      "networkWatcherName": {
        "type": "String",
        "metadata": {
          "displayName": "Network Watcher name",
          "description": "The name of the network watcher under which the flow log resources are created. Make sure it belongs to the same region as the network security group."
        }
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Network/networkSecurityGroups"
          },
          {
            "field": "location",
            "equals": "[parameters('nsgRegion')]"
          }
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Network/networkWatchers/flowlogs",
          "resourceGroupName": "[if(empty(coalesce(field('Microsoft.Network/networkSecurityGroups/flowLogs'))), parameters('networkWatcherRG'), split(first(field('Microsoft.Network/networkSecurityGroups/flowLogs[*].id')), '/')[4])]",
          "name": "[if(empty(coalesce(field('Microsoft.Network/networkSecurityGroups/flowLogs[*].id'))), 'null/null', concat(split(first(field('Microsoft.Network/networkSecurityGroups/flowLogs[*].id')), '/')[8], '/', split(first(field('Microsoft.Network/networkSecurityGroups/flowLogs[*].id')), '/')[10]))]",
          "existenceCondition": {
            "anyof": [
              {
                "field": "Microsoft.Network/networkWatchers/flowLogs/enabled",
                "equals": "false"
              },
              {
                "allof": [
                  {
                    "field": "Microsoft.Network/networkWatchers/flowLogs/enabled",
                    "equals": "true"
                  },
                  {
                    "field": "Microsoft.Network/networkWatchers/flowLogs/storageId",
                    "equals": "[parameters('storageId')]"
                  },
                  {
                    "field": "Microsoft.Network/networkWatchers/flowLogs/flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled",
                    "equals": "true"
                  },
                  {
                    "field": "Microsoft.Network/networkWatchers/flowLogs/flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.trafficAnalyticsInterval",
                    "in": [ "10", "60" ]
                  },
                  {
                    "field": "Microsoft.Network/networkWatchers/flowLogs/flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.workspaceId",
                    "equals": "[parameters('workspaceId')]"
                  }
                ]
              }
            ]
          },

          "roleDefinitionIds": [
            "/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
          ],
          "deployment": {
            "properties": {
              "mode": "incremental",
              "template": {
                "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "parameters": {
                  "storageId": {
                    "type": "String"
                  },
                  "timeInterval": {
                    "type": "String"
                  },
                  "workspaceId": {
                    "type": "String"
                  },
                  "workspaceRegion": {
                    "type": "String"
                  },
                  "workspaceResourceId": {
                    "type": "String"
                  },
                  "networkWatcherRG": {
                    "type": "String"
                  },
                  "networkWatcherName": {
                    "type": "String"
                  },
                  "flowlogName": {
                    "type": "String"
                  },
                  "location": {
                    "type": "String"
                  },
                  "targetResource": {
                    "type": "string"
                  }
                },
                "resources": [
                  {
                    "type": "Microsoft.Resources/deployments",
                    "name": "[concat('flowlogDeployment-', uniqueString(parameters('flowlogName')))]",
                    "apiVersion": "2019-10-01",
                    "resourceGroup": "[parameters('networkWatcherRG')]",
                    "properties": {
                      "mode": "incremental",
                      "parameters": {},
                      "template": {
                        "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                        "contentVersion": "1.0.0.0",
                        "parameters": {},
                        "resources": [
                          {
                            "type": "Microsoft.Network/networkWatchers/flowLogs",
                            "name": "[concat(parameters('networkWatcherName'), '/', parameters('flowlogName'))]",
                            "apiVersion": "2019-11-01",
                            "location": "[parameters('location')]",
                            "properties": {
                              "targetResourceId": "[parameters('targetResource')]",
                              "storageId": "[parameters('storageId')]",
                              "enabled": "true",
                              "flowAnalyticsConfiguration": {
                                "networkWatcherFlowAnalyticsConfiguration": {
                                  "enabled": true,
                                  "workspaceId": "[parameters('workspaceId')]",
                                  "workspaceRegion": "[parameters('workspaceRegion')]",
                                  "workspaceResourceId": "[parameters('workspaceResourceId')]",
                                  "trafficAnalyticsInterval": "[parameters('timeInterval')]"
                                }
                              },
                              "retentionPolicy": {
                                "days": "0",
                                "enabled": "false"
                              },
                              "format": {
                                "type": "JSON",
                                "version": 2
                              }
                            }
                          }
                        ]
                      }
                    }
                  }
                ]
              },
              "parameters": {
                "storageId": {
                  "value": "[parameters('storageId')]"
                },
                "timeInterval": {
                  "value": "[parameters('timeInterval')]"
                },
                "workspaceId": {
                  "value": "[parameters('workspaceId')]"
                },
                "workspaceRegion": {
                  "value": "[parameters('workspaceRegion')]"
                },
                "workspaceResourceId": {
                  "value": "[parameters('workspaceResourceId')]"
                },
                "networkWatcherRG": {
                  "value": "[if(empty(coalesce(field('Microsoft.Network/networkSecurityGroups/flowLogs'))), parameters('networkWatcherRG'), split(first(field('Microsoft.Network/networkSecurityGroups/flowLogs[*].id')), '/')[4])]"
                },
                "networkWatcherName": {
                  "value": "[if(empty(coalesce(field('Microsoft.Network/networkSecurityGroups/flowLogs'))), parameters('networkWatcherName'), split(first(field('Microsoft.Network/networkSecurityGroups/flowLogs[*].id')), '/')[8])]"
                },
                "flowlogName": {
                  "value": "[if(empty(coalesce(field('Microsoft.Network/networkSecurityGroups/flowLogs'))), concat(field('name'), '-', resourceGroup().name, '-', 'flowlog'), split(first(field('Microsoft.Network/networkSecurityGroups/flowLogs[*].id')), '/')[10])]"
                },
                "location": {
                  "value": "[field('location')]"
                },
                "targetResource": {
                  "value": "[concat(resourceGroup().id, '/providers/Microsoft.Network/networkSecurityGroups/', field('name'))]"
                }
              }
            }
          }
        }
      }
    }
  },
  
  "id": "/providers/Microsoft.Authorization/policyDefinitions/5e1cd26a-5090-4fdb-9d6a-84a90335e22d", 
  "name": "5e1cd26a-5090-4fdb-9d6a-84a90335e22d"
}