Microsoft Azure Storage Account Blob Lifecycle Management Policy Drift Sentinel

id: azure-storage-blob-tiering-lifecycle-drift-sentinel
namespace: company.cloud

inputs:
  - id: subscription_id
    type: STRING
    description: Azure Subscription ID.
  - id: resource_group
    type: STRING
    description: Azure Resource Group name.
  - id: storage_account_name
    type: STRING
    description: Azure Storage Account name to audit.

tasks:
  - id: audit_lifecycle_policy
    type: io.kestra.plugin.scripts.shell.Commands
    containerImage: mcr.microsoft.com/azure-cli:latest
    commands:
      - |
        az login --service-principal -u "{{ secret('AZURE_CLIENT_ID') }}" -p "{{ secret('AZURE_CLIENT_SECRET') }}" --tenant "{{ secret('AZURE_TENANT_ID') }}" --output none
        az account set --subscription "{{ inputs.subscription_id }}"

        # Check management policy rules on storage account
        az storage account management-policy show           --account-name "{{ inputs.storage_account_name }}"           --resource-group "{{ inputs.resource_group }}"           --output json > /tmp/lifecycle_telemetry.json 2>/dev/null || echo '{"policy":{"rules":[]}}' > /tmp/lifecycle_telemetry.json

        RULES_COUNT=$(jq '.policy.rules | length // 0' /tmp/lifecycle_telemetry.json)
        echo "::set-output name=rules_count::$RULES_COUNT::"

  - id: evaluate_policy_drift
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.audit_lifecycle_policy.vars.rules_count | int == 0 }}"
    then:
      - id: notify_finops_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#cloud-finops",
            "attachments": [
              {
                "color": "warning",
                "title": "💰 Azure Storage Account Lifecycle Policy Drift Alert",
                "text": "Storage Account `{{ inputs.storage_account_name }}` has *no active lifecycle management rules* configured! Blobs remain indefinitely on the expensive Hot tier without transitioning to Cool, Cold, or Archive tiers.",
                "footer": "Kestra Cloud Sentinel • Microsoft Azure FinOps"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#cloud-ops",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ Azure Storage Lifecycle Sentinel Failure",
            "text": "Failed to inspect Azure Storage management policies. Verify storage account name and service principal access.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "0 9 * * 1"
    disabled: true
    inputs:
      subscription_id: replace-with-your-subscription-id
      resource_group: replace-with-your-resource-group
      storage_account_name: replace-with-your-storage-account-name