Google Cloud Armor Security Policy Block Spike and DDoS Sentinel

id: gcp-cloud-armor-security-policy-block-spike-sentinel
namespace: company.cloud

inputs:
  - id: project_id
    type: STRING
    description: Google Cloud Project ID.
  - id: security_policy_name
    type: STRING
    description: Cloud Armor Security Policy name.
  - id: block_threshold
    type: INT
    defaults: 500
    description: "Maximum allowable blocked requests in 5-minute sampling interval
      (default 500)."

tasks:
  - id: query_blocked_requests
    type: io.kestra.plugin.gcp.cli.GCloudCLI
    projectId: "{{ inputs.project_id }}"
    serviceAccount: "{{ secret('GCP_SERVICE_ACCOUNT') }}"
    commands:
      - |
        FILTER='metric.type="loadbalancing.googleapis.com/https/backend_request_count" AND metric.labels.response_code_class="400" AND resource.labels.url_map_name!=""'
        START_TIME=$(date -u -v-15M +%Y-%m-%dT%H:%M:%SZ)

        gcloud monitoring timeseries list           --filter="$FILTER"           --interval-start-time="$START_TIME"           --format=json > /tmp/cloud_armor_telemetry.json

        TOTAL_BLOCKED=$(jq '[.[]?.points[]?.value.int64Value // 0] | add // 0' /tmp/cloud_armor_telemetry.json)
        echo "::set-output name=blocked_requests::$TOTAL_BLOCKED::"

  - id: evaluate_block_spike
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.query_blocked_requests.vars.blocked_requests | int >
      inputs.block_threshold }}"
    then:
      - id: notify_soc_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#soc-alerts",
            "attachments": [
              {
                "color": "danger",
                "title": "🚨 Google Cloud Armor Security Spike Alert",
                "text": "Security Policy `{{ inputs.security_policy_name }}` in project `{{ inputs.project_id }}` recorded *{{ outputs.query_blocked_requests.vars.blocked_requests }} blocked requests* over the last 15 minutes! Layer-7 volumetric DDoS attack, SQL injection (SQLi), or credential stuffing wave detected at edge load balancers.",
                "footer": "Kestra Cloud Sentinel • Google Cloud Armor"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#soc-alerts",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ Cloud Armor Sentinel Failure",
            "text": "Failed to query Cloud Monitoring for Cloud Armor metrics. Verify project ID and credentials.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true
    inputs:
      project_id: replace-with-your-project-id
      security_policy_name: replace-with-your-security-policy-name