AWS Route53 DNS Health Check Failure and Failover Sentinel

id: aws-route53-health-check-status-sentinel
namespace: company.netops

inputs:
  - id: health_check_id
    type: STRING
    defaults: 1234abcd-56ef-78gh-90ij-1234567890kl
    description: Identifier of the AWS Route53 health check to inspect.

tasks:
  - id: query_health_check_status
    type: io.kestra.plugin.aws.cli.AwsCLI
    region: us-east-1
    accessKeyId: "{{ secret('AWS_ACCESS_KEY_ID') }}"
    secretKeyId: "{{ secret('AWS_SECRET_ACCESS_KEY') }}"
    commands:
      - |
        aws route53 get-health-check-status           --health-check-id "{{ inputs.health_check_id }}"           --output json > r53_health.json
        python3 -c "
        import json
        with open('r53_health.json') as f:
            checkers = json.load(f).get('HealthCheckObservations', [])
        failed_observations = []
        for o in checkers:
            status = o.get('StatusReport', {}).get('Status', '')
            if 'Success' not in status:
                failed_observations.append({
                    'region': o.get('Region', 'unknown'),
                    'ip': o.get('IPAddress'),
                    'status': status
                })
        is_failing = len(failed_observations) > (len(checkers) / 2) if checkers else False
        result = {
            'health_check_id': '{{ inputs.health_check_id }}',
            'total_observations': len(checkers),
            'failed_observations_count': len(failed_observations),
            'failed_observations': failed_observations[:5],
            'alert_triggered': is_failing
        }
        with open('r53_summary.json', 'w') as out:
            json.dump(result, out)
        print('Route53 audit:', result)
        "
    outputFiles:
      - r53_summary.json

  - id: evaluate_endpoint_health
    type: io.kestra.plugin.core.flow.If
    condition: "{{
      fromJson(read(outputs.query_health_check_status.outputFiles['r53_summary.\
      json'])).alert_triggered }}"
    then:
      - id: alert_sre_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "text": ":rotating_light: *AWS Route53 Health Check Alert*: Health check `{{ inputs.health_check_id }}` has failed across {{ fromJson(read(outputs.query_health_check_status.outputFiles['r53_summary.json'])).failed_observations_count }} global checkers. DNS failover routing has been engaged."
          }

errors:
  - id: notify_sentinel_error
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "text": ":warning: *Route53 Sentinel Failure*: Failed to query status for health check `{{ inputs.health_check_id }}`."
      }

triggers:
  - id: scheduled_health_check
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/5 * * * *"
    disabled: true