Microsoft Azure Key Vault Secret and Certificate Expiration Sentinel

id: azure-keyvault-secret-certificate-expiration-sentinel
namespace: company.cloud

inputs:
  - id: vault_name
    type: STRING
    description: Azure Key Vault name to audit.
  - id: expiration_warning_days
    type: INT
    defaults: 30
    description: "Number of days before expiration to trigger warning alerts
      (default 30 days)."

tasks:
  - id: audit_expiring_credentials
    type: io.kestra.plugin.scripts.shell.Commands
    containerImage: mcr.microsoft.com/azure-cli:latest
    commands:
      - |
        az login --service-principal -u "{{ secret('AZURE_CLIENT_ID') }}" -p "{{ secret('AZURE_CLIENT_SECRET') }}" --tenant "{{ secret('AZURE_TENANT_ID') }}" --output none

        # List secrets with expiration timestamps
        az keyvault secret list           --vault-name "{{ inputs.vault_name }}"           --query "[?attributes.expires != null].{name:name, expires:attributes.expires}"           --output json > /tmp/vault_telemetry.json

        EXPIRING_COUNT=$(python3 -c "import json, datetime; data=json.load(open('/tmp/vault_telemetry.json')); now=datetime.datetime.now(datetime.timezone.utc); limit=now+datetime.timedelta(days={{ inputs.expiration_warning_days }}); print(len([s for s in data if datetime.datetime.fromisoformat(s['expires'].replace('Z', '+00:00')) <= limit]))")
        echo "::set-output name=expiring_count::$EXPIRING_COUNT::"

  - id: evaluate_credential_expiration
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.audit_expiring_credentials.vars.expiring_count | int > 0 }}"
    then:
      - id: notify_security_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#security-ops",
            "attachments": [
              {
                "color": "warning",
                "title": "🔐 Azure Key Vault Credential Expiration Warning",
                "text": "Key Vault `{{ inputs.vault_name }}` contains *{{ outputs.audit_expiring_credentials.vars.expiring_count }} credentials* expiring within the next {{ inputs.expiration_warning_days }} days! Immediate rotation is required to prevent authentication downtime.",
                "footer": "Kestra Cloud Sentinel • Microsoft Azure Security"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#security-ops",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ Azure Key Vault Expiration Sentinel Failure",
            "text": "Failed to inspect Azure Key Vault secrets. Verify vault name and service principal Key Vault secret read permissions.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "0 8 * * *"
    disabled: true
    inputs:
      vault_name: replace-with-your-vault-name