--- policy: /ce/ca/aws/ecs/fargate-service-version logic: /ce/ca/aws/ecs/fargate-service-version/prod.logic.yaml executionTime: 2026-06-06T12:02:49.357653908Z generationMs: 41 executionMs: 948 rows: - id: test1 match: true status: expected: DISAPPEARED actual: DISAPPEARED conditionIndex: expected: 99 actual: 99 conditionText: expected: isDisappeared(CA10__disappearanceTime__c) actual: isDisappeared(CA10__disappearanceTime__c) runtimeError: {} - id: test2 match: true status: expected: INAPPLICABLE actual: INAPPLICABLE conditionIndex: expected: 299 actual: 299 conditionText: expected: extract('CA10__launchType__c') != 'FARGATE' actual: extract('CA10__launchType__c') != 'FARGATE' runtimeError: {} - id: test3 match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 499 actual: 499 conditionText: expected: extract('CA10__platformVersion__c') == 'LATEST' actual: extract('CA10__platformVersion__c') == 'LATEST' runtimeError: {} - id: test4 match: true status: expected: INAPPLICABLE actual: INAPPLICABLE conditionIndex: expected: 199 actual: 199 conditionText: expected: extract('CA10__status__c') != 'ACTIVE' actual: extract('CA10__status__c') != 'ACTIVE' runtimeError: {} - id: test5 match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 399 actual: 399 conditionText: expected: extract('CA10__platformVersion__c') == '1.3.0' actual: extract('CA10__platformVersion__c') == '1.3.0' runtimeError: {} - id: test6 match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 599 actual: 599 conditionText: expected: extract('CA10__platformVersion__c') == '1.4.0' actual: extract('CA10__platformVersion__c') == '1.4.0' runtimeError: {} usedFiles: - path: /ce/ca/aws/ecs/fargate-service-version/policy.yaml md5Hash: 05B38C5B997DF6463165EEA2B6DD5B6E content: | --- names: full: "AWS ECS Fargate Service platform version is outdated" contextual: "Fargate Service platform version is outdated" description: > Ensure that AWS ECS services running on Fargate are configured to use the LATEST platform version. Using the LATEST platform version ensures that tasks automatically use the most current, stable runtime environment, which includes the newest features and security patches. type: "COMPLIANCE_POLICY" categories: - "RELIABILITY" frameworkMappings: - "/frameworks/cloudaware/resource-reliability/infrastructure-modernization" - "/frameworks/aws-fsbp-v1.0.0/ecs/10" similarPolicies: awsSecurityHub: - name: "[ECS.10] ECS Fargate services should run on the latest Fargate platform version" url: "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-10" - path: /ce/ca/aws/ecs/fargate-service-version/prod.logic.yaml md5Hash: 5D93996FE282025F34191CC56D5F4B36 content: | --- inputType: "CA10__CaAwsEcsService__c" testData: - file: "test-data.json" importExtracts: - file: "/types/CA10__CaAwsEcsService__c/object.extracts.yaml" conditions: - status: "INAPPLICABLE" currentStateMessage: "The service is not active." check: NOT_EQUAL: left: EXTRACT: "CA10__status__c" right: TEXT: "ACTIVE" - status: "INAPPLICABLE" currentStateMessage: "The ECS service does not use the Fargate launch type." check: NOT_EQUAL: left: EXTRACT: "CA10__launchType__c" right: TEXT: "FARGATE" - status: "INCOMPLIANT" currentStateMessage: "The ECS Fargate service is using the outdated platform version 1.3.0." remediationMessage: "Update the service to use platform version 1.4.0 or LATEST." check: IS_EQUAL: left: EXTRACT: "CA10__platformVersion__c" right: TEXT: "1.3.0" - status: "COMPLIANT" currentStateMessage: "The ECS Fargate service is using a recent platform version." check: IS_EQUAL: left: EXTRACT: "CA10__platformVersion__c" right: TEXT: "LATEST" - status: "COMPLIANT" currentStateMessage: "The ECS Fargate service is using a recent platform version." check: IS_EQUAL: left: EXTRACT: "CA10__platformVersion__c" right: TEXT: "1.4.0" otherwise: status: "COMPLIANT" currentStateMessage: "The ECS Fargate service is using a recent platform version." - path: /ce/ca/aws/ecs/fargate-service-version/test-data.json md5Hash: 6430AA9EBC4DFDE33282D22465610092 content: |- [ { "expectedResult": { "runtimeError": null, "conditionText": "isDisappeared(CA10__disappearanceTime__c)", "conditionIndex": 99, "status": "DISAPPEARED" }, "context": { "snapshotTime": "2025-12-12T04:42:59Z" }, "CA10__platformVersion__c": "", "Id": "test1", "CA10__disappearanceTime__c": "2025-12-05T02:07:04Z", "CA10__launchType__c": "EC2", "CA10__status__c": "ACTIVE" }, { "expectedResult": { "runtimeError": null, "conditionText": "extract('CA10__launchType__c') != 'FARGATE'", "conditionIndex": 299, "status": "INAPPLICABLE" }, "context": { "snapshotTime": "2025-12-12T04:42:59Z" }, "CA10__platformVersion__c": "LATEST", "Id": "test2", "CA10__disappearanceTime__c": null, "CA10__launchType__c": "", "CA10__status__c": "ACTIVE" }, { "expectedResult": { "runtimeError": null, "conditionText": "extract('CA10__platformVersion__c') == 'LATEST'", "conditionIndex": 499, "status": "COMPLIANT" }, "context": { "snapshotTime": "2025-12-12T04:42:59Z" }, "CA10__platformVersion__c": "LATEST", "Id": "test3", "CA10__disappearanceTime__c": null, "CA10__launchType__c": "FARGATE", "CA10__status__c": "ACTIVE" }, { "expectedResult": { "runtimeError": null, "conditionText": "extract('CA10__status__c') != 'ACTIVE'", "conditionIndex": 199, "status": "INAPPLICABLE" }, "context": { "snapshotTime": "2025-12-12T04:42:59Z" }, "CA10__platformVersion__c": "LATEST", "Id": "test4", "CA10__disappearanceTime__c": null, "CA10__launchType__c": "EC2", "CA10__status__c": "INACTIVE" }, { "expectedResult": { "runtimeError": null, "conditionText": "extract('CA10__platformVersion__c') == '1.3.0'", "conditionIndex": 399, "status": "INCOMPLIANT" }, "context": { "snapshotTime": "2025-12-12T04:42:59Z" }, "CA10__platformVersion__c": "1.3.0", "Id": "test5", "CA10__disappearanceTime__c": null, "CA10__launchType__c": "FARGATE", "CA10__status__c": "ACTIVE" }, { "expectedResult": { "runtimeError": null, "conditionText": "extract('CA10__platformVersion__c') == '1.4.0'", "conditionIndex": 599, "status": "COMPLIANT" }, "context": { "snapshotTime": "2025-12-12T04:42:59Z" }, "CA10__platformVersion__c": "1.4.0", "Id": "test6", "CA10__disappearanceTime__c": null, "CA10__launchType__c": "FARGATE", "CA10__status__c": "ACTIVE" } ] - path: /types/CA10__CaAwsEcsService__c/object.extracts.yaml md5Hash: DE9B8176332CECD4A8C53207B8DA95F0 content: | --- extracts: # Values: Enabled | Disabled. Not nullable. - name: "CA10__assignPublicIp__c" value: FIELD: path: "CA10__assignPublicIp__c" undeterminedIf: noAccessDelegate: path: "CA10__assignPublicIp__c" currentStateMessage: "Service Assign Public IP config cannot be empty. Possible permission issue with ecs:DescribeServices" # Values: ACTIVE | DRAINING | INACTIVE. Not nullable. - name: "CA10__status__c" value: FIELD: path: "CA10__status__c" undeterminedIf: noAccessDelegate: path: "CA10__status__c" currentStateMessage: "Service status cannot be empty. Possible permission issue with ecs:DescribeServices" # Values: EC2 | FARGATE | EXTERNAL | MANAGED_INSTANCES # Nullable - name: "CA10__launchType__c" value: FIELD: path: "CA10__launchType__c" # Nullable. - name: "CA10__platformVersion__c" value: FIELD: path: "CA10__platformVersion__c" script: |- CREATE TEMP FUNCTION mock_ExpectedResult() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "Id" : "test1", "expectedResult" : { "runtimeError" : null, "conditionText" : "isDisappeared(CA10__disappearanceTime__c)", "conditionIndex" : 99, "status" : "DISAPPEARED" } }, { "Id" : "test2", "expectedResult" : { "runtimeError" : null, "conditionText" : "extract('CA10__launchType__c') != 'FARGATE'", "conditionIndex" : 299, "status" : "INAPPLICABLE" } }, { "Id" : "test3", "expectedResult" : { "runtimeError" : null, "conditionText" : "extract('CA10__platformVersion__c') == 'LATEST'", "conditionIndex" : 499, "status" : "COMPLIANT" } }, { "Id" : "test4", "expectedResult" : { "runtimeError" : null, "conditionText" : "extract('CA10__status__c') != 'ACTIVE'", "conditionIndex" : 199, "status" : "INAPPLICABLE" } }, { "Id" : "test5", "expectedResult" : { "runtimeError" : null, "conditionText" : "extract('CA10__platformVersion__c') == '1.3.0'", "conditionIndex" : 399, "status" : "INCOMPLIANT" } }, { "Id" : "test6", "expectedResult" : { "runtimeError" : null, "conditionText" : "extract('CA10__platformVersion__c') == '1.4.0'", "conditionIndex" : 599, "status" : "COMPLIANT" } } ]; """; CREATE TEMP FUNCTION mock_CA10__CaAwsEcsService__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "context" : { "snapshotTime" : new Date("2025-12-12T04:42:59Z") }, "CA10__disappearanceTime__c" : new Date("2025-12-05T02:07:04Z"), "CA10__status__c" : "ACTIVE", "CA10__launchType__c" : "EC2", "CA10__platformVersion__c" : "", "Id" : "test1" }, { "context" : { "snapshotTime" : new Date("2025-12-12T04:42:59Z") }, "CA10__status__c" : "ACTIVE", "CA10__launchType__c" : "", "CA10__platformVersion__c" : "LATEST", "Id" : "test2" }, { "context" : { "snapshotTime" : new Date("2025-12-12T04:42:59Z") }, "CA10__status__c" : "ACTIVE", "CA10__launchType__c" : "FARGATE", "CA10__platformVersion__c" : "LATEST", "Id" : "test3" }, { "context" : { "snapshotTime" : new Date("2025-12-12T04:42:59Z") }, "CA10__status__c" : "INACTIVE", "CA10__launchType__c" : "EC2", "CA10__platformVersion__c" : "LATEST", "Id" : "test4" }, { "context" : { "snapshotTime" : new Date("2025-12-12T04:42:59Z") }, "CA10__status__c" : "ACTIVE", "CA10__launchType__c" : "FARGATE", "CA10__platformVersion__c" : "1.3.0", "Id" : "test5" }, { "context" : { "snapshotTime" : new Date("2025-12-12T04:42:59Z") }, "CA10__status__c" : "ACTIVE", "CA10__launchType__c" : "FARGATE", "CA10__platformVersion__c" : "1.4.0", "Id" : "test6" } ]; """; CREATE TEMP FUNCTION process_CA10__CaAwsEcsService__c( obj STRUCT< CA10__disappearanceTime__c TIMESTAMP, CA10__status__c STRING, CA10__launchType__c STRING, CA10__platformVersion__c STRING, Id STRING >, snapshotTime TIMESTAMP ) RETURNS STRUCT DETERMINISTIC LANGUAGE js AS r""" var TextLib = new function () { this.normalize = function(arg) { return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase(); }; this.isEmpty = function(arg) { return this.normalize(arg) == ''; }; this.isNotEmpty = function(arg) { return this.normalize(arg) != ''; }; this.equal = function(left, right) { return this.normalize(left) == this.normalize(right); }; this.notEqual = function(left, right) { return this.normalize(left) != this.normalize(right); }; this.startsWith = function(arg, substring) { return this.normalize(arg).startsWith(this.normalize(substring)); }; this.endsWith = function(arg, substring) { return this.normalize(arg).endsWith(this.normalize(substring)); }; this.contains = function(arg, substring) { return this.normalize(arg).includes(this.normalize(substring)); }; this.containsAll = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.every(sub => normalizedArg.includes(this.normalize(sub))); }; this.containsAny = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.some(sub => normalizedArg.includes(this.normalize(sub))); }; }(); var references1 = []; // condition[0], conditionIndex:[0..99] references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c); if (obj.CA10__disappearanceTime__c != null) { return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[1], conditionIndex:[100..199] function fieldChecked4() { if (TextLib.isEmpty(obj.CA10__status__c)) { throw new Error("UNDETERMINED condition:101", {cause: {status: 'UNDETERMINED', conditionIndex: 101, conditionText: "CA10__status__c.delegatedTo(CA10__status__c).isEmpty()", currentStateMessage: "Service status cannot be empty. Possible permission issue with ecs:DescribeServices", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}}); } return obj.CA10__status__c; } function extract3() { if (!this.out) { this.out = fieldChecked4(); } return this.out; }; references1.push('Status [obj.CA10__status__c]: ' + obj.CA10__status__c); try { if (TextLib.notEqual(extract3.call(extract3), 'ACTIVE')) { return {status: 'INAPPLICABLE', conditionIndex: 199, conditionText: "extract('CA10__status__c') != 'ACTIVE'", currentStateMessage: "The service is not active.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } } catch (err) { if (err.cause && err.cause.status) { return err.cause; } else { throw err; } } // condition[2], conditionIndex:[200..299] function extract6() { if (!this.out) { this.out = obj.CA10__launchType__c; } return this.out; }; references1.push('Launch Type [obj.CA10__launchType__c]: ' + obj.CA10__launchType__c); if (TextLib.notEqual(extract6.call(extract6), 'FARGATE')) { return {status: 'INAPPLICABLE', conditionIndex: 299, conditionText: "extract('CA10__launchType__c') != 'FARGATE'", currentStateMessage: "The ECS service does not use the Fargate launch type.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[3], conditionIndex:[300..399] function extract9() { if (!this.out) { this.out = obj.CA10__platformVersion__c; } return this.out; }; references1.push('Platform Version [obj.CA10__platformVersion__c]: ' + obj.CA10__platformVersion__c); if (TextLib.equal(extract9.call(extract9), '1.3.0')) { return {status: 'INCOMPLIANT', conditionIndex: 399, conditionText: "extract('CA10__platformVersion__c') == '1.3.0'", currentStateMessage: "The ECS Fargate service is using the outdated platform version 1.3.0.", currentStateReferences: references1.join('\n'), remediation: "Update the service to use platform version 1.4.0 or LATEST.", runtimeError: null}; } // condition[4], conditionIndex:[400..499] function extract12() { if (!this.out) { this.out = obj.CA10__platformVersion__c; } return this.out; }; if (TextLib.equal(extract12.call(extract12), 'LATEST')) { return {status: 'COMPLIANT', conditionIndex: 499, conditionText: "extract('CA10__platformVersion__c') == 'LATEST'", currentStateMessage: "The ECS Fargate service is using a recent platform version.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[5], conditionIndex:[500..599] function extract15() { if (!this.out) { this.out = obj.CA10__platformVersion__c; } return this.out; }; if (TextLib.equal(extract15.call(extract15), '1.4.0')) { return {status: 'COMPLIANT', conditionIndex: 599, conditionText: "extract('CA10__platformVersion__c') == '1.4.0'", currentStateMessage: "The ECS Fargate service is using a recent platform version.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } return {status: 'COMPLIANT', conditionIndex: 600, conditionText: "otherwise", currentStateMessage: "The ECS Fargate service is using a recent platform version.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; """; SELECT expectedResult.Id as Id, IF ( IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '') AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1) AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '') AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''), "MATCH", "FAIL" ) as match, expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus, expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex, expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText, expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError FROM UNNEST(mock_ExpectedResult()) expectedResult LEFT JOIN ( SELECT sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c, sObject.CA10__status__c AS CA10__status__c, sObject.CA10__launchType__c AS CA10__launchType__c, sObject.CA10__platformVersion__c AS CA10__platformVersion__c, sObject.Id AS Id, process_CA10__CaAwsEcsService__c( STRUCT( sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c, sObject.CA10__status__c AS CA10__status__c, sObject.CA10__launchType__c AS CA10__launchType__c, sObject.CA10__platformVersion__c AS CA10__platformVersion__c, sObject.Id AS Id ), sObject.context.snapshotTime ) as result FROM UNNEST(mock_CA10__CaAwsEcsService__c()) AS sObject ) sObject ON sObject.Id = expectedResult.Id;