Event grid policy

{
    "properties": {
        "name": "AE-EnforceEventGrid",
        "displayName": "AE - Enforce Event Grid",
        "description": "Enforces an Event Grid Topic & Subscription on the AE storage accounts where NSG Logs are pushed with the Azure function as the subscription's endpoint.",
        "policyType": "Custom",
        "mode": "All",
        "parameters": {
            "functionId": {
                "type": "String"
            },
            "location": {
                "type": "String",
                "defaultValue": "australiaeast"
            }
        },
        "policyRule": {
            "if": {
                "allof": [
                    {
                        "field": "type",
                        "equals": "Microsoft.Storage/storageAccounts"
                    },
                    {
                        "field": "name",
                        "like": "*nsglog"
                    },
                    {
                        "field": "location",
                        "equals": "[parameters('location')]"
                    }
                ]
            },
            "then": {
                "effect": "deployIfNotExists",
                "details": {
                    "type": "Microsoft.EventGrid/eventSubscriptions",
                    "existenceCondition": {
                        "allof": [
                            {
                                "field": "name",
                                "equals": "[field('name')]"
                            },
                            {
                                "field": "Microsoft.EventGrid/eventSubscriptions/topic",
                                "notEquals": "[parameters('functionId')]"
                            }
                        ]
                    },
                    "roleDefinitionIds": [
                        "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
                        "/providers/Microsoft.Authorization/roleDefinitions/428e0ff0-5e57-4d9c-a221-2c70d0e0a443",
                        "/providers/Microsoft.Authorization/roleDefinitions/c12c1c16-33a1-487b-954d-41c89c60f349"
                    ],
                    "deployment": {
                        "properties": {
                            "mode": "incremental",
                            "template": {
                                "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                                "contentVersion": "1.0.0.0",
                                "parameters": {
                                    "storage_account_name": {
                                        "type": "String"
                                    },
                                    "functionId": {
                                        "type": "String"
                                    },
                                    "location": {
                                        "type": "String"
                                    }
                                },
                                "resources": [
                                    {
                                        "type": "Microsoft.EventGrid/systemTopics",
                                        "apiVersion": "2020-04-01-preview",
                                        "name": "[parameters('storage_account_name')]",
                                        "location": "[parameters('location')]",
                                        "properties": {
                                            "source": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storage_account_name'))]",
                                            "topicType": "Microsoft.Storage.StorageAccounts"
                                        }
                                    },
                                    {
                                        "type": "Microsoft.EventGrid/systemTopics/eventSubscriptions",
                                        "apiVersion": "2020-04-01-preview",
                                        "name": "[concat(parameters('storage_account_name'), '/', parameters('storage_account_name'))]",
                                        "dependsOn": [
                                            "[resourceId('Microsoft.EventGrid/systemTopics', parameters('storage_account_name'))]"
                                        ],
                                        "properties": {
                                            "destination": {
                                                "properties": {
                                                    "resourceId": "[concat(parameters('AEfunctionId'), '/functions/nsgflowlogs-processor')]",
                                                    "maxEventsPerBatch": 1,
                                                    "preferredBatchSizeInKilobytes": 64
                                                },
                                                "endpointType": "AzureFunction"
                                            },
                                            "filter": {
                                                "subjectBeginsWith": "/blobServices/default/containers/insights-logs-networksecuritygroupflowevent/",
                                                "includedEventTypes": [
                                                    "Microsoft.Storage.BlobCreated"
                                                ]
                                            }
                                        }
                                    }
                                ]
                            },
                            "parameters": {
                                "storage_account_name": {
                                    "value": "[field('name')]"
                                },
                                "functionId": {
                                    "value": "[parameters('AEfunctionId')]"
                                },
                                "location": {
                                    "value": "[parameters('location')]"
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}