AWS CloudWatch Log Group Indefinite Retention and Cost Leak Sentinel

id: aws-cloudwatch-log-retention-cost-leak-sentinel
namespace: company.cloud

inputs:
  - id: aws_region
    type: STRING
    defaults: "us-east-1"
    description: Target AWS region.
  - id: unexpiring_log_threshold
    type: INT
    defaults: 0
    description: Maximum acceptable count of CloudWatch log groups with Never Expire
      retention.

tasks:
  - id: audit_log_retention
    type: io.kestra.plugin.aws.cli.AwsCLI
    region: "{{ inputs.aws_region }}"
    accessKeyId: "{{ secret('AWS_ACCESS_KEY_ID') }}"
    secretKeyId: "{{ secret('AWS_SECRET_ACCESS_KEY') }}"
    commands:
      - |
        aws logs describe-log-groups --query "logGroups[?!not_null(retentionInDays)].{Name:logGroupName,StoredBytes:storedBytes}" --output json > /tmp/unexpiring_logs.json

        UNEXPIRING_COUNT=$(jq 'length' /tmp/unexpiring_logs.json)
        TOTAL_BYTES=$(jq '[.[].StoredBytes] | add // 0' /tmp/unexpiring_logs.json)
        UNEXPIRING_LOGS=$(jq -c '.[0:10]' /tmp/unexpiring_logs.json)

        echo "::set-output name=unexpiring_count::$UNEXPIRING_COUNT::"
        echo "::set-output name=total_bytes::$TOTAL_BYTES::"
        echo "::set-output name=log_samples::$UNEXPIRING_LOGS::"

  - id: evaluate_retention_compliance
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.audit_log_retention.vars.unexpiring_count | int >
      inputs.unexpiring_log_threshold }}"
    then:
      - id: notify_finops_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#finops-cost-alerts",
            "attachments": [
              {
                "color": "warning",
                "title": "⚠️ AWS CloudWatch Log Group Indefinite Retention Cost Leak",
                "text": "Detected *{{ outputs.audit_log_retention.vars.unexpiring_count }}* log group(s) with retention set to *Never Expire* (total stored bytes: {{ outputs.audit_log_retention.vars.total_bytes }}). Sample log groups: {{ outputs.audit_log_retention.vars.log_samples }}. Impact: Unbounded storage growth incurs compounding monthly CloudWatch Logs storage costs.",
                "footer": "Kestra FinOps Orchestrator • CloudWatch Retention Sentinel"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#finops-cost-alerts",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ CloudWatch Retention Sentinel Execution Failed",
            "text": "The AWS CloudWatch log group retention audit failed. Please verify IAM permissions for logs:DescribeLogGroups.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "0 8 * * 1"
    disabled: true