Lock down MinIO buckets left open to anonymous access

id: minio-public-bucket-anonymous-policy-lockdown-guard
namespace: company.team

description: |
  Find MinIO buckets that serve their objects to anyone on the internet through an anonymous
  download, upload or public policy, then lock them down. The scan reads every bucket's anonymous
  policy with the MinIO client, the native MinIO plugin inventories the objects each exposed bucket
  is handing out with no credentials. A gated remediation runs mc anonymous set none behind an
  approval before re-reading the policy and failing the run if any targeted bucket is still open.
  A bucket you keep public on purpose stays public when you add it to the allowlist.

inputs:
  - id: dry_run
    type: BOOL
    defaults: true
    description: When true the flow only reports exposed buckets and never changes a policy.

  - id: auto_remediate
    type: BOOL
    defaults: false
    description: When true (and dry_run is false) the flow locks exposed buckets
      down after approval.

  - id: minio_endpoint
    type: STRING
    defaults: http://minio.internal:9000
    description: MinIO S3 API endpoint URL. Both the native plugin and the mc client
      connect to it.

  - id: minio_access_key
    type: STRING
    defaults: "{{ secret('MINIO_ACCESS_KEY_ID') }}"
    description: MinIO access key. Defaults to the MINIO_ACCESS_KEY_ID secret and
      needs rights to read and set bucket policies.

  - id: minio_secret_key
    type: STRING
    defaults: "{{ secret('MINIO_SECRET_KEY_ID') }}"
    description: MinIO secret key. Defaults to the MINIO_SECRET_KEY_ID secret.

  - id: allowlist
    type: ARRAY
    itemType: STRING
    defaults: []
    description: Buckets that are public on purpose, such as a static site bucket.
      They are reported as spared and never changed. Empty by default so nothing
      public is ignored by accident.

  - id: max_lockdowns
    type: INT
    defaults: 25
    description: Ceiling on how many buckets one run may lock down. More flagged
      than this looks like a mis-scoped run or a wrong endpoint, so the flow
      refuses to write and alerts instead.

  - id: mc_image
    type: STRING
    defaults: minio/mc:latest
    description: Container image carrying the mc client. Override to pin a version
      or point at an internal mirror.

  - id: docker_network
    type: STRING
    defaults: bridge
    description: Docker network the mc client container joins so it can reach the
      MinIO endpoint. Default bridge reaches any routable address. Set it to the
      user-defined network your MinIO container is on when the endpoint is a
      container name.

triggers:
  - id: daily
    type: io.kestra.plugin.core.trigger.Schedule
    description: Audit anonymous bucket policies daily. Safe mode is forced here, so
      a scheduled run only reports.
    cron: "0 6 * * *"
    disabled: true
    inputs:
      dry_run: true
      auto_remediate: false

tasks:
  - id: scan_policies
    type: io.kestra.plugin.scripts.shell.Commands
    description: >-
      List every bucket with the mc client and read each one's anonymous policy.
      A bucket whose policy is anything other than private is exposed. Exposed
      buckets that are not on the allowlist are flagged. A connection or
      credential failure fails the task so an unreachable endpoint can never
      read as a clean result.
    containerImage: "{{ inputs.mc_image }}"
    taskRunner:
      type: io.kestra.plugin.scripts.runner.docker.Docker
      networkMode: "{{ inputs.docker_network }}"
    env:
      MC_CONFIG_DIR: /tmp/.mc
      HOME: /tmp
      ENDPOINT: "{{ inputs.minio_endpoint }}"
      ACCESS: "{{ inputs.minio_access_key }}"
      SECRET: "{{ inputs.minio_secret_key }}"
      ALLOW_JSON: "{{ inputs.allowlist | toJson }}"
    commands:
      - |
        set -e
        mc alias set audit "$ENDPOINT" "$ACCESS" "$SECRET" >/dev/null
        if ! mc ls audit >/dev/null 2>&1; then
          echo "cannot reach MinIO at $ENDPOINT or credentials rejected" >&2
          exit 1
        fi
        mc ls --json audit 2>/dev/null | jq -r 'select(.key != null) | .key | rtrimstr("/")' > /tmp/buckets.txt
        : > /tmp/rows.jsonl
        while IFS= read -r b; do
          [ -z "$b" ] && continue
          perm=$(mc --json anonymous get audit/"$b" 2>/dev/null | jq -r '.permission // "unknown"')
          jq -nc --arg b "$b" --arg p "$perm" '{bucket:$b, permission:$p}' >> /tmp/rows.jsonl
        done < /tmp/buckets.txt
        jq -sc --arg allow_json "$ALLOW_JSON" '
          ($allow_json | fromjson) as $al
          | map(. + {exposed: (.permission != "private" and .permission != "unknown")})
          | map(. + {allowlisted: (.bucket as $b | ($al | index($b)) != null)})
          | {
              scanned: length,
              buckets: .,
              flagged: (map(select(.exposed and (.allowlisted | not)))),
              flagged_names: (map(select(.exposed and (.allowlisted | not)) | .bucket)),
              spared_names: (map(select(.exposed and .allowlisted) | .bucket)),
              flagged_count: (map(select(.exposed and (.allowlisted | not))) | length),
              flagged_csv: (map(select(.exposed and (.allowlisted | not)) | .bucket) | join(", ")),
              spared_count: (map(select(.exposed and .allowlisted)) | length),
              exposed_count: (map(select(.exposed)) | length)
            }
        ' /tmp/rows.jsonl > /tmp/out.json
        echo "scanned=$(jq -r .scanned /tmp/out.json) exposed=$(jq -r .exposed_count /tmp/out.json) flagged=$(jq -r .flagged_count /tmp/out.json) spared=$(jq -rc .spared_names /tmp/out.json)"
        jq -c '{outputs: .}' /tmp/out.json | sed 's/^/::/; s/$/::/'

  - id: inventory_exposed
    type: io.kestra.plugin.core.flow.Loop
    description: For each flagged bucket, read the objects it is handing out to
      anonymous callers, so the blast radius is on the record before anything is
      changed.
    values: "{{ outputs.scan_policies.vars.flagged_names }}"
    concurrencyLimit: 4
    tasks:
      - id: list_objects
        type: io.kestra.plugin.minio.List
        description: List the objects an unauthenticated client can read from this
          exposed bucket.
        endpoint: "{{ inputs.minio_endpoint }}"
        accessKeyId: "{{ inputs.minio_access_key }}"
        secretKeyId: "{{ inputs.minio_secret_key }}"
        bucket: "{{ item.value }}"
        recursive: true
        filter: FILES
      - id: log_exposure
        type: io.kestra.plugin.core.log.Log
        message: "Exposed bucket {{ item.value }} is readable with no credentials and
          holds {{ (outputs.list_objects.objects ?? []) | length }} object(s)."

  - id: gate
    type: io.kestra.plugin.core.flow.If
    description: Lock buckets down only when auto_remediate is true, dry_run is
      false and something is actually flagged. Any other combination reports and
      stops.
    condition: "{{ inputs.auto_remediate and (inputs.dry_run == false) and
      ((outputs.scan_policies.vars.flagged_names | length) > 0) }}"
    then:
      - id: ceiling_check
        type: io.kestra.plugin.core.flow.If
        description: Refuse to mass-change policies when the flagged count is over the
          ceiling, which usually means a wrong endpoint or a mis-scoped run.
        condition: "{{ (outputs.scan_policies.vars.flagged_names | length) <=
          inputs.max_lockdowns }}"
        then:
          - id: confirm
            type: io.kestra.plugin.core.flow.Pause
            description: >-
              Hold for a human before any policy is changed. Approving removes
              anonymous access from every flagged bucket. That breaks any
              anonymous client currently reading from those buckets, which is
              the whole point of the lockdown, so the decision is a person's to
              make.
            onResume:
              - id: approved
                type: BOOL
                description: Set true to remove anonymous access from the flagged buckets. Leave
                  false or unset to make no change.
          - id: apply
            type: io.kestra.plugin.core.flow.If
            description: Only proceed past the pause when it was explicitly approved. An
              unanswered pause never reads as approval.
            condition: "{{ outputs.confirm.onResume.approved ?? false }}"
            then:
              - id: remediate_buckets
                type: io.kestra.plugin.core.flow.Loop
                description: Lock each flagged bucket down and prove it. Serial, because
                  concurrent policy writes on one endpoint race.
                values: "{{ outputs.scan_policies.vars.flagged_names }}"
                concurrencyLimit: 1
                tasks:
                  - id: set_none
                    type: io.kestra.plugin.scripts.shell.Commands
                    description: Remove the anonymous policy from this bucket with mc anonymous set
                      none.
                    containerImage: "{{ inputs.mc_image }}"
                    taskRunner:
                      type: io.kestra.plugin.scripts.runner.docker.Docker
                      networkMode: "{{ inputs.docker_network }}"
                    env:
                      MC_CONFIG_DIR: /tmp/.mc
                      HOME: /tmp
                      ENDPOINT: "{{ inputs.minio_endpoint }}"
                      ACCESS: "{{ inputs.minio_access_key }}"
                      SECRET: "{{ inputs.minio_secret_key }}"
                      BUCKET: "{{ item.value }}"
                    commands:
                      - |
                        set -e
                        mc alias set audit "$ENDPOINT" "$ACCESS" "$SECRET" >/dev/null
                        mc anonymous set none audit/"$BUCKET"
                  - id: reverify_bucket
                    type: io.kestra.plugin.scripts.shell.Commands
                    description: Read the anonymous policy again. This is the authoritative proof
                      the lockdown landed.
                    containerImage: "{{ inputs.mc_image }}"
                    taskRunner:
                      type: io.kestra.plugin.scripts.runner.docker.Docker
                      networkMode: "{{ inputs.docker_network }}"
                    env:
                      MC_CONFIG_DIR: /tmp/.mc
                      HOME: /tmp
                      ENDPOINT: "{{ inputs.minio_endpoint }}"
                      ACCESS: "{{ inputs.minio_access_key }}"
                      SECRET: "{{ inputs.minio_secret_key }}"
                      BUCKET: "{{ item.value }}"
                    commands:
                      - |
                        set -e
                        mc alias set audit "$ENDPOINT" "$ACCESS" "$SECRET" >/dev/null
                        perm=$(mc --json anonymous get audit/"$BUCKET" 2>/dev/null | jq -r '.permission // "unknown"')
                        echo "reverify $BUCKET -> $perm"
                        echo "::{\"outputs\":{\"perm\":\"$perm\"}}::"
                  - id: assert_locked
                    type: io.kestra.plugin.core.flow.If
                    description: Fail the run if the bucket is still exposed after the lockdown, so
                      a change that did not land is never reported as success.
                    condition: "{{ outputs.reverify_bucket.vars.perm == 'private' }}"
                    then:
                      - id: locked_ok
                        type: io.kestra.plugin.core.log.Log
                        message: "Bucket {{ item.value }} is now private."
                    else:
                      - id: still_exposed
                        type: io.kestra.plugin.core.execution.Fail
                        errorMessage: "Bucket {{ item.value }} still has anonymous policy '{{
                          outputs.reverify_bucket.vars.perm }}' after lockdown."
            else:
              - id: declined
                type: io.kestra.plugin.core.log.Log
                message: "Approval was declined, so {{ outputs.scan_policies.vars.flagged_count
                  }} exposed bucket(s) were left unchanged."
        else:
          - id: too_many
            type: io.kestra.plugin.core.execution.Fail
            errorMessage: "{{ outputs.scan_policies.vars.flagged_count }} flagged bucket(s)
              exceeds max_lockdowns ({{ inputs.max_lockdowns }}). Refusing to
              mass-change policies. Check the endpoint and the scope."
    else:
      - id: no_write
        type: io.kestra.plugin.core.log.Log
        message: >-
          No policy was changed. dry_run={{ inputs.dry_run }}, auto_remediate={{
          inputs.auto_remediate }}, flagged={{
          outputs.scan_policies.vars.flagged_count }} ({{
          outputs.scan_policies.vars.flagged_names }}), spared={{
          outputs.scan_policies.vars.spared_names }}. Set dry_run=false and
          auto_remediate=true to lock the flagged buckets down.

  - id: report
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Post a run summary to Slack.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "MinIO anonymous policy guard: scanned {{ outputs.scan_policies.vars.scanned }} bucket(s), {{ outputs.scan_policies.vars.flagged_count }} flagged ({{ outputs.scan_policies.vars.flagged_csv }}), {{ outputs.scan_policies.vars.spared_count }} spared by allowlist. dry_run={{ inputs.dry_run }}, auto_remediate={{ inputs.auto_remediate }} (execution {{ execution.id }})."
      }

errors:
  - id: alert_on_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Alert Slack when the scan fails, a lockdown errors or a bucket is
      still exposed after remediation.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "MinIO anonymous policy guard FAILED (execution {{ execution.id }}). A bucket may still be exposed or the endpoint was unreachable. Check the logs."
      }