How can you find a different TargetObject via id?

[C0smin]

Hi,
I'm looking into making a rule for ActivityLog_StorageAccountBYOK but the question hopefully has a more general answer to help more people if possible.
What would be a good way to get a different resource from the same deployment?
The jist of it is that I want to check if storageAccount1 has any logs in storageDiagnostics1, then storageDiagnostics1 should use properties.encryption.keySource='Microsoft.KeyVault'
Something like:

resource storageAccount1 'Microsoft.Storage/storageAccounts@2022-05-01' = {
  name: 'storageAccount1'
  location: location
  kind: 'StorageV2'
  sku: {
    name: 'Standard_LRS'
  }
}

resource storageDiagnostics1 'Microsoft.Storage/storageAccounts@2022-09-01' = {
  name: 'storageDiagnostics1'
  location: location
  kind: 'StorageV2'
  sku: {
    name: 'Standard_LRS'
  }
}

resource storageDiagnostics 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  name: 'default'
  scope: storageAccount
  properties: {
    storageAccountId: storageDiagnostics1.id
    metrics: [
      {
        category: 'Transaction'
        enabled: true
      }
    ]
  }
}

Rule -Type 'Microsoft.Storage/storageAccounts' -Body {
    $diagnosticSettings = GetSubResources -ResourceType 'Microsoft.Insights/diagnosticSettings'
    if ($diagnosticSettings) {
        $diagnosticsStorageAccount = Get-PSRuleItem $diagnosticSettings.properties.storageAccountId # <-- How can I write this to work?
        $Assert.HasFieldValue($diagnosticsStorageAccount, 'properties.encryption.keySource', 'Microsoft.KeyVault')
    }
}

Thanks for getting to this part, does anyone have an idea?

[BernieWhite]

@C0smin Yeah that is a tricky one. PSRule for Azure today doesn't provide a good solution to co-ordinate or follow relationships between resources. The exception is parent and sub-resources.

So storageDiagnostics is nested in storageAccount1 as discussed in #1969. However there isn't an equivalent of Get-PSRuleItem available today.

One way you could approach it would be to create a rule based on the Microsoft.Resources/deployments resource, however the downside here is that you will need to process an un-expanded ARM template structure.

---

If the community would find such a feature helpful please upvote this idea over here #1984.

[C0smin]

Thanks for the fast reply!
Sad to hear that it's currently not available but I'm hoping we get some upvotes 🤞