AWS S3 Account Public Access Block Configuration Drift Sentinel

id: aws-s3-public-access-block-drift-sentinel
namespace: company.ops

inputs:
  - id: aws_region
    type: STRING
    defaults: us-east-1
    description: AWS region to target.

tasks:
  - id: get_public_access_block
    type: io.kestra.plugin.aws.cli.AwsCLI
    accessKeyId: "{{ secret('AWS_ACCESS_KEY_ID') }}"
    secretKeyId: "{{ secret('AWS_SECRET_ACCESS_KEY') }}"
    region: "{{ inputs.aws_region }}"
    commands:
      - |
        ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
        aws s3control get-public-access-block --account-id "$ACCOUNT_ID" --output json > /tmp/pab.json
        cat /tmp/pab.json
        BLOCK_PUBLIC_ACLS=$(jq -r '.PublicAccessBlockConfiguration.BlockPublicAcls' /tmp/pab.json)
        IGNORE_PUBLIC_ACLS=$(jq -r '.PublicAccessBlockConfiguration.IgnorePublicAcls' /tmp/pab.json)
        BLOCK_PUBLIC_POLICY=$(jq -r '.PublicAccessBlockConfiguration.BlockPublicPolicy' /tmp/pab.json)
        RESTRICT_PUBLIC_BUCKETS=$(jq -r '.PublicAccessBlockConfiguration.RestrictPublicBuckets' /tmp/pab.json)
        if [ "$BLOCK_PUBLIC_ACLS" = "true" ] && [ "$IGNORE_PUBLIC_ACLS" = "true" ] && [ "$BLOCK_PUBLIC_POLICY" = "true" ] && [ "$RESTRICT_PUBLIC_BUCKETS" = "true" ]; then
          echo '{"drift_detected": false, "block_public_acls": true, "ignore_public_acls": true, "block_public_policy": true, "restrict_public_buckets": true}'
        else
          echo "{\"drift_detected\": true, \"block_public_acls\": $BLOCK_PUBLIC_ACLS, \"ignore_public_acls\": $IGNORE_PUBLIC_ACLS, \"block_public_policy\": $BLOCK_PUBLIC_POLICY, \"restrict_public_buckets\": $RESTRICT_PUBLIC_BUCKETS}"
        fi

  - id: evaluate_drift
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.get_public_access_block.vars.drift_detected |
      default(false) }}"
    then:
      - id: alert_slack
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "text": ":rotating_light: *AWS S3 Public Access Block Drift Detected*\nAccount-level S3 public access block settings are not fully enabled.\n• BlockPublicAcls: `{{ outputs.get_public_access_block.vars.block_public_acls }}`\n• IgnorePublicAcls: `{{ outputs.get_public_access_block.vars.ignore_public_acls }}`\n• BlockPublicPolicy: `{{ outputs.get_public_access_block.vars.block_public_policy }}`\n• RestrictPublicBuckets: `{{ outputs.get_public_access_block.vars.restrict_public_buckets }}`\nRegion: `{{ inputs.aws_region }}`"
          }
    else:
      - id: log_ok
        type: io.kestra.plugin.core.log.Log
        message: "All S3 account-level public access block settings are enabled. No
          drift detected."

errors:
  - id: error_alert
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "text": ":x: *AWS S3 Public Access Block Sentinel failed*\nExecution `{{ execution.id }}` encountered an error: `{{ error.message }}`"
      }

triggers:
  - id: scheduled_sentinel_check
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true