AWS Site-to-Site VPN Tunnel State Down Sentinel

id: aws-vpn-tunnel-state-down-sentinel
namespace: company.netops

inputs:
  - id: aws_region
    type: STRING
    defaults: us-east-1
    description: AWS region where Site-to-Site VPN connections reside.

tasks:
  - id: audit_vpn_connections
    type: io.kestra.plugin.aws.cli.AwsCLI
    region: "{{ inputs.aws_region }}"
    accessKeyId: "{{ secret('AWS_ACCESS_KEY_ID') }}"
    secretKeyId: "{{ secret('AWS_SECRET_ACCESS_KEY') }}"
    commands:
      - |
        aws ec2 describe-vpn-connections --output json > vpn_conns.json
        python3 -c "
        import json
        with open('vpn_conns.json') as f:
            conns = json.load(f).get('VpnConnections', [])
        degraded_vpns = []
        for c in conns:
            vpn_id = c.get('VpnConnectionId')
            tunnels = c.get('VgwTelemetry', [])
            down_tunnels = [t for t in tunnels if t.get('Status') != 'UP']
            if down_tunnels:
                degraded_vpns.append({
                    'vpn_id': vpn_id,
                    'total_tunnels': len(tunnels),
                    'down_tunnels_count': len(down_tunnels),
                    'down_details': [{'ip': t.get('OutsideIpAddress'), 'status': t.get('Status')} for t in down_tunnels]
                })
        result = {
            'region': '{{ inputs.aws_region }}',
            'degraded_vpns_count': len(degraded_vpns),
            'degraded_vpns': degraded_vpns,
            'alert_triggered': len(degraded_vpns) > 0
        }
        with open('vpn_summary.json', 'w') as out:
            json.dump(result, out)
        print('VPN audit:', result)
        "
    outputFiles:
      - vpn_summary.json

  - id: evaluate_vpn_health
    type: io.kestra.plugin.core.flow.If
    condition: "{{
      fromJson(read(outputs.audit_vpn_connections.outputFiles['vpn_summary.json\
      '])).alert_triggered }}"
    then:
      - id: alert_netops_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "text": ":warning: *AWS Site-to-Site VPN Tunnel Down Alert*: Found {{ fromJson(read(outputs.audit_vpn_connections.outputFiles['vpn_summary.json'])).degraded_vpns_count }} VPN connections with down IPsec tunnels in {{ inputs.aws_region }}. Redundancy is compromised."
          }

errors:
  - id: notify_sentinel_error
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "text": ":warning: *VPN Sentinel Failure*: Failed to describe VPN connections in {{ inputs.aws_region }}."
      }

triggers:
  - id: scheduled_vpn_check
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/10 * * * *"
    disabled: true