Google Cloud Storage (GCS) Bucket Lifecycle Policy Drift Sentinel

id: gcp-gcs-bucket-retention-lifecycle-drift-sentinel
namespace: company.cloud

inputs:
  - id: project_id
    type: STRING
    description: Google Cloud Project ID.
  - id: bucket_name
    type: STRING
    description: GCS bucket name to audit for lifecycle expiration rules.

tasks:
  - id: check_bucket_lifecycle
    type: io.kestra.plugin.gcp.cli.GCloudCLI
    projectId: "{{ inputs.project_id }}"
    serviceAccount: "{{ secret('GCP_SERVICE_ACCOUNT') }}"
    commands:
      - |
        gcloud storage buckets describe "gs://{{ inputs.bucket_name }}" --format=json > /tmp/bucket_meta.json

        RULES_COUNT=$(jq '.lifecycle.rule | length // 0' /tmp/bucket_meta.json)
        DELETE_RULES=$(jq '[.lifecycle.rule[]? | select(.action.type == "Delete")] | length' /tmp/bucket_meta.json)

        echo "::set-output name=rules_count::$RULES_COUNT::"
        echo "::set-output name=delete_rules::$DELETE_RULES::"

  - id: evaluate_lifecycle_drift
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.check_bucket_lifecycle.vars.delete_rules | int == 0 }}"
    then:
      - id: notify_finops_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#finops-alerts",
            "attachments": [
              {
                "color": "warning",
                "title": "💰 GCS Bucket Missing Lifecycle Policy Drift Detected",
                "text": "Bucket `gs://{{ inputs.bucket_name }}` in project `{{ inputs.project_id }}` has NO object deletion or expiration lifecycle rules configured! Impact: Temporary logs, scratch artifacts, or staging datasets accumulate indefinitely, leading to unbounded storage cost leaks.",
                "footer": "Kestra FinOps Sentinel • Google Cloud Storage"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#finops-alerts",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ Google Cloud Storage (GCS) Bucket Lifecycle Policy Drift Sentinel Pipeline Failure",
            "text": "Failed to inspect GCS bucket metadata. Verify bucket name and IAM permissions.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true