--- policy: /ce/ca/aws/ecs/task-definition-secrets-as-environment-variables logic: /ce/ca/aws/ecs/task-definition-secrets-as-environment-variables/prod.logic.yaml executionTime: 2026-06-06T12:02:50.517342704Z generationMs: 51 executionMs: 1000 rows: - id: test1 match: true status: expected: DISAPPEARED actual: DISAPPEARED conditionIndex: expected: 99 actual: 99 conditionText: expected: isDisappeared(CA10__disappearanceTime__c) actual: isDisappeared(CA10__disappearanceTime__c) runtimeError: {} - id: test2 match: true status: expected: INAPPLICABLE actual: INAPPLICABLE conditionIndex: expected: 199 actual: 199 conditionText: expected: extract('CA10__status__c') != 'ACTIVE' actual: extract('CA10__status__c') != 'ACTIVE' runtimeError: {} - id: test3 match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 299 actual: 299 conditionText: expected: CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT) actual: CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT) runtimeError: {} - id: test4 match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 300 actual: 300 conditionText: expected: otherwise actual: otherwise runtimeError: {} usedFiles: - path: /ce/ca/aws/ecs/task-definition-secrets-as-environment-variables/policy.yaml md5Hash: 5BC3A77939E40C9A7B747039E348FC05 content: | --- names: full: "AWS ECS Task Definition passes secrets as container environment variables" contextual: "Task Definition passes secrets as container environment variables" description: > Ensure that AWS ECS Task Definitions do not pass sensitive information, such as passwords, tokens, or API keys, as plaintext environment variables. Storing secrets in plaintext exposes them to anyone with read access to the task definition or console. Secrets should instead be injected from AWS Systems Manager Parameter Store or AWS Secrets Manager. type: "COMPLIANCE_POLICY" categories: - "SECURITY" frameworkMappings: - "/frameworks/cloudaware/resource-security/secure-access" - "/frameworks/aws-fsbp-v1.0.0/ecs/08" similarPolicies: awsSecurityHub: - name: "[ECS.8] Secrets should not be passed as container environment variables" url: "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-8" - path: /ce/ca/aws/ecs/task-definition-secrets-as-environment-variables/prod.logic.yaml md5Hash: BDBD1A8DA7161124F9D569A43D3FD9DD content: |+ --- inputType: "CA10__CaAwsEcsTaskDefinition__c" testData: - file: "test-data.json" importExtracts: - file: "/types/CA10__CaAwsEcsTaskDefinition__c/object.extracts.yaml" - file: "/types/CA10__CaAwsEcsContainerDefinition__c/object.extracts.yaml" conditions: - status: "INAPPLICABLE" currentStateMessage: "The task definition is not active." check: NOT_EQUAL: left: EXTRACT: "CA10__status__c" right: TEXT: "ACTIVE" - status: "INCOMPLIANT" currentStateMessage: "The task definition contains environment variables with\ \ names indicating sensitive data (e.g., AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, ECS_ENGINE_AUTH_DATA)." remediationMessage: "Move sensitive data to AWS Secrets Manager or SSM Parameter\ \ Store and reference them using the secrets parameter." check: RELATED_LIST_HAS: status: "INCOMPLIANT" relationshipName: "CA10__AWS_ECS_Container_Definitions__r" otherwise: status: "COMPLIANT" currentStateMessage: "No obvious secrets are detected in plaintext environment variables (e.g., AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, ECS_ENGINE_AUTH_DATA)." relatedLists: - relationshipName: "CA10__AWS_ECS_Container_Definitions__r" conditions: - status: "INCOMPLIANT" currentStateMessage: "The container contains ECS_ENGINE_AUTH_DATA secret in environment variables." check: CONTAINS: arg: EXTRACT: "CA10__environment__c" search: BYTES: "ECS_ENGINE_AUTH_DATA" - status: "INCOMPLIANT" currentStateMessage: "The container contains PASSWORD secret in environment variables." check: CONTAINS: arg: EXTRACT: "CA10__environment__c" search: BYTES: "PASSWORD" - status: "INCOMPLIANT" currentStateMessage: "The container contains SECRET in environment variables." check: CONTAINS: arg: EXTRACT: "CA10__environment__c" search: BYTES: "SECRET" - status: "INCOMPLIANT" currentStateMessage: "The container contains API_KEY secret in environment variables." check: CONTAINS: arg: EXTRACT: "CA10__environment__c" search: BYTES: "API_KEY" - status: "INCOMPLIANT" currentStateMessage: "The container contains ACCESS_KEY secret in environment variables." check: CONTAINS: arg: EXTRACT: "CA10__environment__c" search: BYTES: "ACCESS_KEY" - status: "INCOMPLIANT" currentStateMessage: "The container contains TOKEN secret in environment variables." check: CONTAINS: arg: EXTRACT: "CA10__environment__c" search: BYTES: "TOKEN" otherwise: status: "COMPLIANT" currentStateMessage: "The container does not contain any secrets in environment variables." - path: /ce/ca/aws/ecs/task-definition-secrets-as-environment-variables/test-data.json md5Hash: 8181752D434204871F7C07B4341D8834 content: |- [ { "expectedResult": { "runtimeError": null, "conditionText": "isDisappeared(CA10__disappearanceTime__c)", "conditionIndex": 99, "status": "DISAPPEARED" }, "CA10__AWS_ECS_Container_Definitions__r": [], "context": { "snapshotTime": "2025-12-12T04:42:59Z" }, "Id": "test1", "CA10__disappearanceTime__c": "2025-07-31T04:38:58Z", "CA10__status__c": "ACTIVE" }, { "expectedResult": { "runtimeError": null, "conditionText": "extract('CA10__status__c') != 'ACTIVE'", "conditionIndex": 199, "status": "INAPPLICABLE" }, "CA10__AWS_ECS_Container_Definitions__r": [ { "CA10__environment__c": "VARIABLE: text\n", "Id": "test2_1", "CA10__disappearanceTime__c": null, "CA10__taskDefinition__c": "test2" } ], "context": { "snapshotTime": "2025-12-12T04:42:59Z" }, "Id": "test2", "CA10__disappearanceTime__c": null, "CA10__status__c": "INACTIVE" }, { "expectedResult": { "runtimeError": null, "conditionText": "CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)", "conditionIndex": 299, "status": "INCOMPLIANT" }, "CA10__AWS_ECS_Container_Definitions__r": [ { "CA10__environment__c": "AWS_SECRET_ACCESS_KEY: secret-access-key\n", "Id": "test3_1", "CA10__disappearanceTime__c": null, "CA10__taskDefinition__c": "test3" } ], "context": { "snapshotTime": "2025-12-12T04:42:59Z" }, "Id": "test3", "CA10__disappearanceTime__c": null, "CA10__status__c": "ACTIVE" }, { "expectedResult": { "runtimeError": null, "conditionText": "otherwise", "conditionIndex": 300, "status": "COMPLIANT" }, "CA10__AWS_ECS_Container_Definitions__r": [ { "CA10__environment__c": "VARIABLE: text\n", "Id": "test4_1", "CA10__disappearanceTime__c": null, "CA10__taskDefinition__c": "test4" } ], "context": { "snapshotTime": "2025-12-12T04:42:59Z" }, "Id": "test4", "CA10__disappearanceTime__c": null, "CA10__status__c": "ACTIVE" } ] - path: /types/CA10__CaAwsEcsContainerDefinition__c/object.extracts.yaml md5Hash: CC5A82BF4FFAB345C4215DD75B708F18 content: "---\nextracts:\n# Checkbox\n - name: \"CA10__privileged__c\"\n value:\n\ \ FIELD:\n path: \"CA10__privileged__c\"\n# Nullable. \n - name:\ \ \"CA10__user__c\"\n value:\n FIELD:\n path: \"CA10__user__c\"\ \n# Checkbox\n - name: \"CA10__readonlyRootFilesystem__c\"\n value:\n \ \ FIELD:\n path: \"CA10__readonlyRootFilesystem__c\"\n - name: \"\ CA10__environment__c\"\n value:\n FIELD:\n returnType: \"BYTES\"\ \n path: \"CA10__environment__c\"\n# Values: json-file | syslog | journald\ \ | gelf | fluentd | awslogs | splunk | awsfirelens\n# Nullable. \n - name:\ \ \"CA10__logConfigurationDriver__c\"\n value:\n FIELD:\n path:\ \ \"CA10__logConfigurationDriver__c\"\n" - path: /types/CA10__CaAwsEcsTaskDefinition__c/object.extracts.yaml md5Hash: 5F3958CAB2B0FF7CE5C1D38F940B5729 content: "---\nextracts:\n# Values: bridge | host | awsvpc | none\n# Nullable.\n\ \ - name: \"CA10__networkMode__c\"\n value:\n FIELD:\n path:\ \ \"CA10__networkMode__c\"\n# Values: ACTIVE | INACTIVE | DELETE_IN_PROGRESS\n\ # Not nullable. \n - name: \"CA10__status__c\"\n value:\n FIELD:\n\ \ path: \"CA10__status__c\"\n undeterminedIf:\n noAccessDelegate:\n\ \ path: \"CA10__status__c\"\n currentStateMessage: \"\ Task Definition status cannot be empty. Possible permission issue with ecs:DescribeTaskDefinition\"\ \n# Values: task | host\n# Nullable.\n - name: \"CA10__pidMode__c\"\n value:\n\ \ FIELD:\n path: \"CA10__pidMode__c\"\n" script: |- CREATE TEMP FUNCTION mock_ExpectedResult() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "Id" : "test1", "expectedResult" : { "runtimeError" : null, "conditionText" : "isDisappeared(CA10__disappearanceTime__c)", "conditionIndex" : 99, "status" : "DISAPPEARED" } }, { "Id" : "test2", "expectedResult" : { "runtimeError" : null, "conditionText" : "extract('CA10__status__c') != 'ACTIVE'", "conditionIndex" : 199, "status" : "INAPPLICABLE" } }, { "Id" : "test3", "expectedResult" : { "runtimeError" : null, "conditionText" : "CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)", "conditionIndex" : 299, "status" : "INCOMPLIANT" } }, { "Id" : "test4", "expectedResult" : { "runtimeError" : null, "conditionText" : "otherwise", "conditionIndex" : 300, "status" : "COMPLIANT" } } ]; """; CREATE TEMP FUNCTION mock_CA10__CaAwsEcsTaskDefinition__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "context" : { "snapshotTime" : new Date("2025-12-12T04:42:59Z") }, "CA10__disappearanceTime__c" : new Date("2025-07-31T04:38:58Z"), "CA10__status__c" : "ACTIVE", "Id" : "test1" }, { "context" : { "snapshotTime" : new Date("2025-12-12T04:42:59Z") }, "CA10__status__c" : "INACTIVE", "Id" : "test2" }, { "context" : { "snapshotTime" : new Date("2025-12-12T04:42:59Z") }, "CA10__status__c" : "ACTIVE", "Id" : "test3" }, { "context" : { "snapshotTime" : new Date("2025-12-12T04:42:59Z") }, "CA10__status__c" : "ACTIVE", "Id" : "test4" } ]; """; CREATE TEMP FUNCTION mock_CA10__CaAwsEcsContainerDefinition__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "context" : { "snapshotTime" : new Date("2025-12-12T04:42:59Z") }, "CA10__environment__c" : "VARIABLE: text\n", "CA10__taskDefinition__c" : "test2", "Id" : "test2_1" }, { "context" : { "snapshotTime" : new Date("2025-12-12T04:42:59Z") }, "CA10__environment__c" : "AWS_SECRET_ACCESS_KEY: secret-access-key\n", "CA10__taskDefinition__c" : "test3", "Id" : "test3_1" }, { "context" : { "snapshotTime" : new Date("2025-12-12T04:42:59Z") }, "CA10__environment__c" : "VARIABLE: text\n", "CA10__taskDefinition__c" : "test4", "Id" : "test4_1" } ]; """; CREATE TEMP FUNCTION process_CA10__CaAwsEcsTaskDefinition__c( obj STRUCT< CA10__disappearanceTime__c TIMESTAMP, CA10__status__c STRING, CA10__AWS_ECS_Container_Definitions__r ARRAY >>, Id STRING >, snapshotTime TIMESTAMP ) RETURNS STRUCT DETERMINISTIC LANGUAGE js AS r""" var TextLib = new function () { this.normalize = function(arg) { return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase(); }; this.isEmpty = function(arg) { return this.normalize(arg) == ''; }; this.isNotEmpty = function(arg) { return this.normalize(arg) != ''; }; this.equal = function(left, right) { return this.normalize(left) == this.normalize(right); }; this.notEqual = function(left, right) { return this.normalize(left) != this.normalize(right); }; this.startsWith = function(arg, substring) { return this.normalize(arg).startsWith(this.normalize(substring)); }; this.endsWith = function(arg, substring) { return this.normalize(arg).endsWith(this.normalize(substring)); }; this.contains = function(arg, substring) { return this.normalize(arg).includes(this.normalize(substring)); }; this.containsAll = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.every(sub => normalizedArg.includes(this.normalize(sub))); }; this.containsAny = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.some(sub => normalizedArg.includes(this.normalize(sub))); }; }(); var references1 = []; // condition[0], conditionIndex:[0..99] references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c); if (obj.CA10__disappearanceTime__c != null) { return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[1], conditionIndex:[100..199] function fieldChecked4() { if (TextLib.isEmpty(obj.CA10__status__c)) { throw new Error("UNDETERMINED condition:101", {cause: {status: 'UNDETERMINED', conditionIndex: 101, conditionText: "CA10__status__c.delegatedTo(CA10__status__c).isEmpty()", currentStateMessage: "Task Definition status cannot be empty. Possible permission issue with ecs:DescribeTaskDefinition", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}}); } return obj.CA10__status__c; } function extract3() { if (!this.out) { this.out = fieldChecked4(); } return this.out; }; references1.push('Status [obj.CA10__status__c]: ' + obj.CA10__status__c); try { if (TextLib.notEqual(extract3.call(extract3), 'ACTIVE')) { return {status: 'INAPPLICABLE', conditionIndex: 199, conditionText: "extract('CA10__status__c') != 'ACTIVE'", currentStateMessage: "The task definition is not active.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } } catch (err) { if (err.cause && err.cause.status) { return err.cause; } else { throw err; } } var count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT5 = 0; if (obj.CA10__AWS_ECS_Container_Definitions__r != null) { for (var i6 = 0; i6 < obj.CA10__AWS_ECS_Container_Definitions__r.length; i6++) { if (typeof(obj.CA10__AWS_ECS_Container_Definitions__r[i6].status) !== 'undefined') { if (obj.CA10__AWS_ECS_Container_Definitions__r[i6].status == 'INCOMPLIANT') { count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT5 += obj.CA10__AWS_ECS_Container_Definitions__r[i6].count; } } else { if (obj.CA10__AWS_ECS_Container_Definitions__r[i6].result.status == 'INCOMPLIANT') { count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT5 += 1; } } } } // condition[2], conditionIndex:[200..299] references1.push('Related list [CA10__AWS_ECS_Container_Definitions__r] ' + (count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT5 > 0 ? 'has' : 'does not have') + ' objects in INCOMPLIANT status'); if (count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT5 > 0) { return {status: 'INCOMPLIANT', conditionIndex: 299, conditionText: "CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)", currentStateMessage: "The task definition contains environment variables with names indicating sensitive data (e.g., AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, ECS_ENGINE_AUTH_DATA).", currentStateReferences: references1.join('\n'), remediation: "Move sensitive data to AWS Secrets Manager or SSM Parameter Store and reference them using the secrets parameter.", runtimeError: null}; } return {status: 'COMPLIANT', conditionIndex: 300, conditionText: "otherwise", currentStateMessage: "No obvious secrets are detected in plaintext environment variables (e.g., AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, ECS_ENGINE_AUTH_DATA).", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; """; CREATE TEMP FUNCTION process_CA10__AWS_ECS_Container_Definitions__r( obj STRUCT< CA10__disappearanceTime__c TIMESTAMP, CA10__environment__c STRING, CA10__taskDefinition__c STRING, Id STRING >, snapshotTime TIMESTAMP ) RETURNS STRUCT DETERMINISTIC LANGUAGE js AS r""" var BytesLib = new function () { this.normalize = function(arg) { return arg == null ? '' : arg; }; this.isEmpty = function(arg) { return this.normalize(arg) == ''; }; this.isNotEmpty = function(arg) { return this.normalize(arg) != ''; }; this.equal = function(left, right) { return this.normalize(left) == this.normalize(right); }; this.notEqual = function(left, right) { return this.normalize(left) != this.normalize(right); }; this.startsWith = function(arg, substring) { return this.normalize(arg).startsWith(this.normalize(substring)); }; this.endsWith = function(arg, substring) { return this.normalize(arg).endsWith(this.normalize(substring)); }; this.contains = function(arg, substring) { return this.normalize(arg).includes(this.normalize(substring)); }; this.containsAll = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.every(sub => normalizedArg.includes(this.normalize(sub))); }; this.containsAny = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.some(sub => normalizedArg.includes(this.normalize(sub))); }; }(); var references1 = []; // condition[0], conditionIndex:[0..99] references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c); if (obj.CA10__disappearanceTime__c != null) { return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[1], conditionIndex:[100..199] function extract3() { if (!this.out) { this.out = obj.CA10__environment__c; } return this.out; }; references1.push('Environment [obj.CA10__environment__c]: ' + obj.CA10__environment__c); if (BytesLib.contains(extract3.call(extract3), 'ECS_ENGINE_AUTH_DATA')) { return {status: 'INCOMPLIANT', conditionIndex: 199, conditionText: "extract('CA10__environment__c').contains(bytes('ECS_ENGINE_AUTH_DATA'))", currentStateMessage: "The container contains ECS_ENGINE_AUTH_DATA secret in environment variables.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[2], conditionIndex:[200..299] function extract6() { if (!this.out) { this.out = obj.CA10__environment__c; } return this.out; }; if (BytesLib.contains(extract6.call(extract6), 'PASSWORD')) { return {status: 'INCOMPLIANT', conditionIndex: 299, conditionText: "extract('CA10__environment__c').contains(bytes('PASSWORD'))", currentStateMessage: "The container contains PASSWORD secret in environment variables.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[3], conditionIndex:[300..399] function extract9() { if (!this.out) { this.out = obj.CA10__environment__c; } return this.out; }; if (BytesLib.contains(extract9.call(extract9), 'SECRET')) { return {status: 'INCOMPLIANT', conditionIndex: 399, conditionText: "extract('CA10__environment__c').contains(bytes('SECRET'))", currentStateMessage: "The container contains SECRET in environment variables.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[4], conditionIndex:[400..499] function extract12() { if (!this.out) { this.out = obj.CA10__environment__c; } return this.out; }; if (BytesLib.contains(extract12.call(extract12), 'API_KEY')) { return {status: 'INCOMPLIANT', conditionIndex: 499, conditionText: "extract('CA10__environment__c').contains(bytes('API_KEY'))", currentStateMessage: "The container contains API_KEY secret in environment variables.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[5], conditionIndex:[500..599] function extract15() { if (!this.out) { this.out = obj.CA10__environment__c; } return this.out; }; if (BytesLib.contains(extract15.call(extract15), 'ACCESS_KEY')) { return {status: 'INCOMPLIANT', conditionIndex: 599, conditionText: "extract('CA10__environment__c').contains(bytes('ACCESS_KEY'))", currentStateMessage: "The container contains ACCESS_KEY secret in environment variables.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[6], conditionIndex:[600..699] function extract18() { if (!this.out) { this.out = obj.CA10__environment__c; } return this.out; }; if (BytesLib.contains(extract18.call(extract18), 'TOKEN')) { return {status: 'INCOMPLIANT', conditionIndex: 699, conditionText: "extract('CA10__environment__c').contains(bytes('TOKEN'))", currentStateMessage: "The container contains TOKEN secret in environment variables.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } return {status: 'COMPLIANT', conditionIndex: 700, conditionText: "otherwise", currentStateMessage: "The container does not contain any secrets in environment variables.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; """; SELECT expectedResult.Id as Id, IF ( IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '') AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1) AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '') AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''), "MATCH", "FAIL" ) as match, expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus, expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex, expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText, expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError FROM UNNEST(mock_ExpectedResult()) expectedResult LEFT JOIN ( SELECT sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c, sObject.CA10__status__c AS CA10__status__c, `CA10__AWS_ECS_Container_Definitions__r`.arr AS CA10__AWS_ECS_Container_Definitions__r, sObject.Id AS Id, process_CA10__CaAwsEcsTaskDefinition__c( STRUCT( sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c, sObject.CA10__status__c AS CA10__status__c, `CA10__AWS_ECS_Container_Definitions__r`.arr AS CA10__AWS_ECS_Container_Definitions__r, sObject.Id AS Id ), sObject.context.snapshotTime ) as result FROM UNNEST(mock_CA10__CaAwsEcsTaskDefinition__c()) AS sObject LEFT JOIN ( SELECT sObject.CA10__taskDefinition__c, ARRAY_AGG( STRUCT( sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c, sObject.CA10__environment__c AS CA10__environment__c, sObject.CA10__taskDefinition__c AS CA10__taskDefinition__c, sObject.Id AS Id, process_CA10__AWS_ECS_Container_Definitions__r( STRUCT( sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c, sObject.CA10__environment__c AS CA10__environment__c, sObject.CA10__taskDefinition__c AS CA10__taskDefinition__c, sObject.Id AS Id ), sObject.context.snapshotTime ) as result ) ) AS arr FROM UNNEST(mock_CA10__CaAwsEcsContainerDefinition__c()) AS sObject GROUP BY sObject.CA10__taskDefinition__c ) AS `CA10__AWS_ECS_Container_Definitions__r` ON sObject.Id = `CA10__AWS_ECS_Container_Definitions__r`.CA10__taskDefinition__c ) sObject ON sObject.Id = expectedResult.Id;