Cloudflare WAF Overly Broad Allowlist Gate

id: cloudflare-waf-overly-broad-allowlist-gate
namespace: company.team
description: |
  List a Cloudflare zone's WAF IP access rules, flag any whitelist rule
  scoped to a whole country or ASN rather than a specific IP or range,
  alert Slack on breach, and conditionally delete the offending rules.
  auto_remediate and dry_run are two independent gates; every other
  access rule - including narrowly-scoped allow rules and all block or
  challenge rules - is left untouched.

triggers:
  - id: periodic_allowlist_check
    type: io.kestra.plugin.core.trigger.Schedule
    description: Check every 6 hours. Shipped disabled; enable it once zone_id
      points at a real zone and a manual run has been verified. Always fires in
      safe mode (auto_remediate false, dry_run true) regardless of this flow's
      own defaults.
    cron: "0 */6 * * *"
    disabled: true
    inputs:
      auto_remediate: "false"
      dry_run: "true"

inputs:
  - id: zone_id
    type: STRING
    defaults: "023e105f4ecef8ad9ca31a8372d0c353"
    displayName: "Cloudflare Zone ID"
    description: Zone whose WAF IP access rules are audited, matching this plugin's
      own documented zoneId property (see cloudflare-canary-deploy.yaml).

  - id: max_broad_allow_rules
    type: INT
    displayName: "Max Allowed Broad Allowlist Rules"
    defaults: 0
    description: Breach when the count of whitelist rules scoped to "country" or
      "asn" exceeds this number. Default 0 means any such rule at all is a
      breach.

  - id: auto_remediate
    type: SELECT
    displayName: "Auto Remediate"
    defaults: "false"
    values:
      - "false"
      - "true"
    description: If "true" and overly broad whitelist rules are found, delete each
      one (still gated by dry_run below). If "false", the risk is only reported.

  - id: dry_run
    type: SELECT
    displayName: "Dry Run"
    defaults: "true"
    values:
      - "true"
      - "false"
    description: If "true", remediation is only logged, no rule is deleted. Must be
      explicitly "false", together with auto_remediate "true", for the rule to
      actually be removed.

tasks:
  - id: audit_waf_access_rules
    type: io.kestra.plugin.cloudflare.waf.accessrules.List
    description: Lists the zone's IP access rules. This task's documented output is
      a rules array where each rule carries id, mode, and
      configuration.{target,value} - verified from the plugin's own output
      schema, which notably does not document a notes or created_on field, so
      this audit is scoped to what the task actually returns. Per the plugin's
      own documentation this lists "using Cloudflare default pagination (first
      page only)" - see this blueprint's Pitfalls.
    apiToken: "{{ secret('CLOUDFLARE_API_TOKEN') }}"
    zoneId: "{{ inputs.zone_id }}"

  - id: evaluate_allowlist_risk
    type: io.kestra.plugin.scripts.python.Script
    description: Reads the listed rules and flags any whitelist rule whose
      configuration.target is "country" or "asn" - a single allow rule scoped to
      an entire country or Autonomous System Number, rather than a specific IP
      or IP range, bypassing the WAF for a potentially enormous swath of
      traffic. There is no structured policy-evaluation task in this plugin, so
      the comparison runs here against the mode/configuration fields the List
      task actually returns.
    inputFiles:
      rules.json: "{{ outputs.audit_waf_access_rules | json }}"
    script: |
      import json
      from kestra import Kestra

      with open("rules.json") as f:
          raw = json.load(f)

      rules = raw.get("rules", []) if isinstance(raw, dict) else raw

      broad_rules = []
      for rule in rules:
          mode = (rule.get("mode") or "").lower()
          configuration = rule.get("configuration") or {}
          target = (configuration.get("target") or "").lower()
          if mode == "whitelist" and target in ("country", "asn"):
              broad_rules.append({
                  "id": rule.get("id"),
                  "target": target,
                  "value": configuration.get("value"),
              })

      Kestra.outputs({
          "broad_count": len(broad_rules),
          "broad_rules": broad_rules,
      })

  - id: evaluate_allowlist_gate
    type: io.kestra.plugin.core.flow.If
    description: Breach when at least one whitelist rule is scoped to a whole
      country or ASN.
    condition: "{{ outputs.evaluate_allowlist_risk.vars.broad_count >
      inputs.max_broad_allow_rules }}"
    then:
      - id: route_remediation
        type: io.kestra.plugin.core.flow.Switch
        description: auto_remediate only decides whether remediation is considered at
          all; dry_run, checked separately below, decides whether the rule is
          actually deleted.
        value: "{{ inputs.auto_remediate }}"
        cases:
          "true":
            - id: check_dry_run
              type: io.kestra.plugin.core.flow.If
              condition: "{{ inputs.dry_run == \"false\" }}"
              then:
                - id: remove_broad_allow_rules
                  type: io.kestra.plugin.core.flow.Loop
                  description: Delete each flagged rule one at a time, so one failed delete never
                    blocks the rest of the batch.
                  values: "{{ outputs.evaluate_allowlist_risk.vars.broad_rules }}"
                  concurrencyLimit: 4
                  tasks:
                    - id: delete_broad_allow_rule
                      type: io.kestra.plugin.cloudflare.waf.accessrules.Delete
                      description: Removes the flagged rule by id, matching this plugin's own
                        documented delete pattern (see
                        cloudflare-canary-deploy.yaml). Only the flagged
                        country/asn-scoped whitelist rule is removed; every
                        other access rule in the zone is untouched.
                      apiToken: "{{ secret('CLOUDFLARE_API_TOKEN') }}"
                      zoneId: "{{ inputs.zone_id }}"
                      ruleId: "{{ item.value | jq('.id') | first }}"
                - id: log_remediation_applied
                  type: io.kestra.plugin.core.log.Log
                  message: "Deleted {{ outputs.evaluate_allowlist_risk.vars.broad_count }} overly
                    broad whitelist rule(s) from zone {{ inputs.zone_id }}."
              else:
                - id: log_dry_run_remediation
                  type: io.kestra.plugin.core.log.Log
                  message: "DRY RUN: would delete {{
                    outputs.evaluate_allowlist_risk.vars.broad_count }} overly
                    broad whitelist rule(s) from zone {{ inputs.zone_id }}
                    (dry_run is true). No change made."
          "false":
            - id: log_remediation_disabled
              type: io.kestra.plugin.core.log.Log
              message: "auto_remediate is false: {{
                outputs.evaluate_allowlist_risk.vars.broad_count }} whitelist
                rule(s) in zone {{ inputs.zone_id }} are scoped to a whole
                country or ASN, but no deletion was attempted."
      - id: alert_allowlist_risk
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: Always alert on any breach, independent of whether it was remediated.
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {
            "text": "Cloudflare WAF allowlist gate: {{ outputs.evaluate_allowlist_risk.vars.broad_count }} whitelist rule(s) in zone {{ inputs.zone_id }} are scoped to a whole country or ASN (threshold {{ inputs.max_broad_allow_rules }}). auto_remediate: {{ inputs.auto_remediate }}. dry_run: {{ inputs.dry_run }}. Remediated: {{ inputs.auto_remediate == \"true\" and inputs.dry_run == \"false\" }}. Execution {{ execution.id }}."
          }
    else:
      - id: log_allowlist_healthy
        type: io.kestra.plugin.core.log.Log
        message: "Zone {{ inputs.zone_id }} is compliant: 0 whitelist rules are scoped
          to a whole country or ASN."

  - id: log_audit_complete
    type: io.kestra.plugin.core.log.Log
    description: Final status line for every run, independent of which branch fired,
      so the execution history always shows the headline numbers.
    message: "WAF allowlist audit complete for zone {{ inputs.zone_id }}.
      broad_count={{ outputs.evaluate_allowlist_risk.vars.broad_count }}.
      threshold={{ inputs.max_broad_allow_rules }}. auto_remediate={{
      inputs.auto_remediate }}. dry_run={{ inputs.dry_run }}."

errors:
  - id: alert_execution_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Alert when the flow itself fails outside the handled branches, for
      example an invalid API token or an unreachable zone.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "Cloudflare WAF allowlist gate FAILED in execution {{ execution.id }} for zone {{ inputs.zone_id }}. The allowlist audit did not complete; investigate before trusting the last known compliance status."
      }