Logic Apps Workflow Tag Compliance Gate with Kestra

id: logicapps-workflow-tag-compliance-gate
namespace: company.team

description: |
  List every Logic App workflow in a resource group, flag workflows missing a required
  governance tag or left in a Disabled state, classify the result COMPLIANT, WARNING, CRITICAL
  or PROBE_FAILED, alert Slack with the exact workflow names and violations, and log a final
  audit summary either way.

inputs:
  - id: resource_group_name
    type: STRING
    displayName: Resource group name
    description: Azure resource group to audit. Maps to the List task's
      resourceGroupName field.
    defaults: "logic-apps-rg"

  - id: required_tags
    type: JSON
    displayName: Required governance tags
    description: Every workflow is expected to carry at least these tag keys,
      regardless of value.
    defaults: '["owner", "cost-center", "environment"]'

  - id: tag_check_mode
    type: SELECT
    displayName: Tag check mode
    description: any_required_missing flags a workflow missing even one required tag
      key. all_required_missing only flags a workflow missing every required tag
      key, catching workflows that were never tagged at all rather than
      partially tagged.
    values:
      - "any_required_missing"
      - "all_required_missing"
    defaults: "any_required_missing"

  - id: flag_disabled_workflows
    type: BOOL
    displayName: Flag disabled workflows
    description: When true, a workflow in Disabled state also counts as a violation
      needing review, independent of its tags.
    defaults: true

  - id: max_workflows
    type: INT
    displayName: Maximum workflows per audit
    description: Maps to the List task's maxWorkflows field.
    defaults: 100

  - id: violation_count_critical_threshold
    type: INT
    displayName: Critical violation count threshold
    description: Violation count at or above which the run is classified CRITICAL
      instead of WARNING.
    defaults: 5

tasks:
  - id: probe_workflows
    type: io.kestra.plugin.azure.logicapps.List
    description: Read-only. Lists every Logic App workflow in resource_group_name
      with its real state and tags.
    allowFailure: true
    tenantId: "{{ secret('AZURE_TENANT_ID') }}"
    clientId: "{{ secret('AZURE_CLIENT_ID') }}"
    clientSecret: "{{ secret('AZURE_CLIENT_SECRET') }}"
    subscriptionId: "{{ secret('AZURE_SUBSCRIPTION_ID') }}"
    resourceGroupName: "{{ inputs.resource_group_name }}"
    maxWorkflows: "{{ inputs.max_workflows }}"

  - id: audit_workflow_governance
    type: io.kestra.plugin.core.output.OutputValues
    description: Flags every workflow missing a required tag, per tag_check_mode, or
      left Disabled when flag_disabled_workflows is true. Empty when the probe
      itself did not return.
    values:
      violations: >-
        {{ (outputs.probe_workflows is not defined) ? '[]' : ({'required':
        inputs.required_tags, 'workflows': outputs.probe_workflows.workflows ??
        [], 'flagDisabled': inputs.flag_disabled_workflows} |
        jq(inputs.tag_check_mode == 'all_required_missing' ? '.required as $req
        | .flagDisabled as $fd | [.workflows[] | . as $w | (($w.tags // {}) |
        keys) as $present | ($req - $present) as $missingTags | (if $fd and
        $w.state == "Disabled" then true else false end) as $isDisabled |
        select((($missingTags|length) == ($req|length)) or $isDisabled) | {name:
        $w.name, missingTags: $missingTags, disabled: $isDisabled}]' :
        '.required as $req | .flagDisabled as $fd | [.workflows[] | . as $w |
        (($w.tags // {}) | keys) as $present | ($req - $present) as $missingTags
        | (if $fd and $w.state == "Disabled" then true else false end) as
        $isDisabled | select((($missingTags|length) > 0) or $isDisabled) |
        {name: $w.name, missingTags: $missingTags, disabled: $isDisabled}]') |
        first | toJson) }}

  - id: classify_governance_status
    type: io.kestra.plugin.core.debug.Return
    description: PROBE_FAILED when the probe produced no output at all, CRITICAL or
      WARNING when flagged workflows meet or fall under the threshold, COMPLIANT
      when there are none.
    format: "{{ outputs.probe_workflows is not defined ? 'PROBE_FAILED' :
      ((fromJson(outputs.audit_workflow_governance.values.violations) | length)
      >= inputs.violation_count_critical_threshold ? 'CRITICAL' :
      ((fromJson(outputs.audit_workflow_governance.values.violations) | length)
      > 0 ? 'WARNING' : 'COMPLIANT')) }}"

  - id: route_by_governance_status
    type: io.kestra.plugin.core.flow.Switch
    description: Branch A logs a fully compliant resource group. Branch B alerts
      Slack when workflows are missing required tags, are Disabled, or the probe
      itself failed.
    value: "{{ outputs.classify_governance_status.value }}"
    cases:
      "COMPLIANT":
        - id: log_compliant
          type: io.kestra.plugin.core.log.Log
          message: "Logic Apps resource group {{ inputs.resource_group_name }} compliant.
            Every workflow has the required tags{{
            inputs.flag_disabled_workflows ? ' and none are Disabled' : '' }}."
      "WARNING":
        - id: alert_warning
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK') }}"
          payload: |
            {{ {"text": "Logic Apps " ~ inputs.resource_group_name ~ " WARNING. " ~ (fromJson(outputs.audit_workflow_governance.values.violations) | length) ~ " workflow(s) flagged: " ~ (fromJson(outputs.audit_workflow_governance.values.violations) | jq('map("\(.name)" + (if .disabled then " [Disabled]" else "" end) + (if (.missingTags|length) > 0 then " missing tags: \(.missingTags | join(", "))" else "" end)) | join("; ")') | first) ~ "."} | toJson }}
      "CRITICAL":
        - id: alert_critical
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK') }}"
          payload: |
            {{ {"text": "Logic Apps " ~ inputs.resource_group_name ~ " CRITICAL. " ~ (fromJson(outputs.audit_workflow_governance.values.violations) | length) ~ " workflow(s) flagged, at or above the " ~ inputs.violation_count_critical_threshold ~ " threshold. Sample: " ~ (fromJson(outputs.audit_workflow_governance.values.violations) | jq('.[0:5] | map("\(.name)" + (if .disabled then " [Disabled]" else "" end) + (if (.missingTags|length) > 0 then " missing tags: \(.missingTags | join(", "))" else "" end)) | join("; ")') | first) ~ "."} | toJson }}
      "PROBE_FAILED":
        - id: alert_probe_failed
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK') }}"
          payload: |
            {{ {"text": "Logic Apps workflow audit on resource group " ~ inputs.resource_group_name ~ " did not return a result. Check resource_group_name, subscriptionId and Azure credentials."} | toJson }}

  - id: log_audit_summary
    type: io.kestra.plugin.core.log.Log
    description: Final audit log confirming the gate ran, regardless of the branch
      taken above.
    message: "Logic Apps workflow tag compliance gate completed. resourceGroup={{
      inputs.resource_group_name }} status={{
      outputs.classify_governance_status.value }} mode={{ inputs.tag_check_mode
      }} flag_disabled={{ inputs.flag_disabled_workflows }}"

errors:
  - id: alert_flow_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {{ {"text": "Logic Apps workflow tag compliance gate flow failed (execution " ~ execution.id ~ "). Check the execution logs."} | toJson }}

triggers:
  - id: daily
    type: io.kestra.plugin.core.trigger.Schedule
    description: Shipped disabled.
    cron: "0 6 * * *"
    disabled: true
    inputs:
      resource_group_name: "logic-apps-rg"
      required_tags: '["owner", "cost-center", "environment"]'
      tag_check_mode: "any_required_missing"
      flag_disabled_workflows: true
      max_workflows: 100
      violation_count_critical_threshold: 5

A Logic App workflow created without the governance tags a FinOps or security policy requires does not fail loudly, it just sits there unattributed, invisible to cost reports and ownership audits until someone goes looking resource group by resource group. A workflow someone disabled during an incident and never re-enabled looks identical to one that was deliberately retired. List already returns every workflow's real state and tags, this blueprint is what reads that report on a schedule and turns it into an alert naming the exact workflow and the exact tag keys missing.

How it works

probe_workflows (io.kestra.plugin.azure.logicapps.List) lists every workflow in resource_group_name, up to max_workflows, with its real state and tags, with allowFailure: true so a bad credential or resource group does not stop the flow before it can be classified as PROBE_FAILED below.
audit_workflow_governance (io.kestra.plugin.core.output.OutputValues) computes, per workflow, which of required_tags are missing from its tags map, and whether its state is exactly Disabled. A workflow is flagged if it fails tag_check_mode's missing-tag rule, or if flag_disabled_workflows is true and it is Disabled, either condition alone is enough.
classify_governance_status (io.kestra.plugin.core.debug.Return) returns PROBE_FAILED when probe_workflows produced no output at all, CRITICAL or WARNING depending on whether the flagged count meets violation_count_critical_threshold, or COMPLIANT when there are none.
route_by_governance_status (io.kestra.plugin.core.flow.Switch) branches on that status: COMPLIANT logs it, WARNING, CRITICAL, and PROBE_FAILED each alert Slack with the exact workflow names, their missing tag keys, and whether they are Disabled, never an invented count.
log_audit_summary always runs last and logs the final classification.
The errors block posts to Slack if the flow itself fails outside the gate logic above.

What you get

A real list of which workflows are missing governance tags and which are sitting Disabled, not an assumption that tagging policy was followed at creation time.
A Slack alert naming the exact workflow and the exact missing tag keys, never an invented number.
A choice of how strict the tag check is (tag_check_mode) and whether Disabled workflows matter at all for a given resource group (flag_disabled_workflows).

Who it's for

Platform and FinOps teams enforcing a tagging policy across Azure resources who need proof Logic Apps workflows actually comply, not just the resources a cost report happens to surface.
Teams running a lot of Logic Apps who want to catch a workflow that was disabled during an incident and never re-enabled, before it is noticed by a user instead of an audit.
Teams evaluating the Logic Apps plugin who want a working example of logicapps.List and the real WorkflowRecord shape it returns.

Why orchestrate this with Kestra

List is a single point-in-time read, Azure Logic Apps itself has no concept of a schedule, a tagging policy, or an alert built from what it finds missing. Kestra adds the recurring audit, the tag completeness check, the Disabled-state check, and a Slack alert built only from the workflows' own reported state and tags, all as one declarative YAML file you can version and review like code.

Prerequisites

An Azure resource group containing Logic App workflows, and a service principal with Microsoft.Logic/workflows/read permission (roles/Logic App Contributor or a reader role is enough, this blueprint only reads).
A Slack incoming webhook for alerts.
Logic Apps is a managed Azure service with no self-hostable open-source emulator, there is no local container to start for it. This plugin calls the Azure Resource Manager API directly from the Kestra worker process, there is no sub-container taskRunner and no Docker network to join.

Secrets

AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID: service principal credentials used by probe_workflows.
SLACK_WEBHOOK: Slack incoming webhook URL used by the alert tasks and the errors block.

In Kestra OSS, set all five as base64-encoded environment variables, for example SECRET_AZURE_TENANT_ID, SECRET_AZURE_SUBSCRIPTION_ID, SECRET_SLACK_WEBHOOK.

Inputs

Input	Type	Default	Allowed values
`resource_group_name`	STRING	`logic-apps-rg`	any Azure resource group name
`required_tags`	JSON	`["owner", "cost-center", "environment"]`	JSON array of tag keys
`tag_check_mode`	SELECT	`any_required_missing`	`any_required_missing`, `all_required_missing`
`flag_disabled_workflows`	BOOL	`true`	`true`, `false`
`max_workflows`	INT	`100`	any positive integer
`violation_count_critical_threshold`	INT	`5`	any non-negative integer

Quick start

Add the Azure and SLACK_WEBHOOK secrets.
Set resource_group_name to a real resource group and required_tags to your actual tagging policy's keys.
Run this flow manually and read log_audit_summary for the result.
Set flag_disabled_workflows: false for a resource group where Disabled workflows are expected and not a concern.
Enable the daily trigger.

How to extend

Check tag values, not just key presence, for example requiring environment to be exactly prod, staging, or dev, by extending the jq filter in audit_workflow_governance.
Add a second probe for a second resource group and reuse the same classification logic to audit a whole subscription's worth of Logic Apps from one flow.
Chain a downstream task after CRITICAL that opens a ticket per flagged workflow with its name and missing tags already filled in, instead of only one Slack message.

Pitfalls

tags comes back as an empty map, not null, for an untagged workflow, in the audit this correctly counts as missing every required tag, confirm that is the behavior you want before enabling all_required_missing on a resource group with many legitimately untagged legacy workflows.
List returns workflows in whatever order the Azure Resource Manager API returns them, not alphabetically or by creation time, do not assume the first max_workflows results are the newest ones.
Disabled here means the Logic Apps-level trigger is turned off, it does not mean the workflow definition was deleted, a Disabled workflow still exists, still carries cost for any static resources it owns, and still needs the same tags.
This blueprint never changes a tag or a workflow's state, there is no remediation task in the Logic Apps plugin for either, the fix has to be applied in the Azure portal, CLI, or your infrastructure-as-code pipeline.

Logic Apps Workflow Tag Compliance Gate

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Inputs

Quick start

How to extend

Pitfalls

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

Logic Apps Workflow Tag Compliance Gate

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Inputs

Quick start

How to extend

Pitfalls

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Infrastructure Blueprints

Meilisearch Indexing Queue Staleness Sentinel

Meilisearch Index Health Sentinel and Search Audit

Memcached Slab Eviction Sentinel

Catch MinIO Replication Drift Before Objects Go Missing on the Target

Enforce default SSE-S3 encryption on a MinIO bucket

Scheduled MinIO Bucket Retention Cleanup

More Cloud Blueprints

Kafka DLQ Quarantine, Classification, and Safe Replay Gate

Audit HTTP Security Headers Across URLs

Kubernetes OOMKilled and CrashLoopBackOff AI Root Cause Sentinel

Huawei DataArts Factory Job Run Health Gate

Huawei Cloud Eye (CES) Metric Threshold Health Gate

Huawei DLI Data Quality Assertion Gate

New to Kestra?