---
policy: /ce/ca/aws/s3/bucket-public-acl
logic: /ce/ca/aws/s3/bucket-public-acl/prod.logic.yaml
executionTime: 2025-11-20T13:28:59.08276987Z
generationMs: 64
executionMs: 661
rows:
  - id: test1
    match: true
    status:
      expected: DISAPPEARED
      actual: DISAPPEARED
    conditionIndex:
      expected: 99
      actual: 99
    conditionText:
      expected: isDisappeared(CA10__disappearanceTime__c)
      actual: isDisappeared(CA10__disappearanceTime__c)
    runtimeError: {}
  - id: test2
    match: true
    status:
      expected: COMPLIANT
      actual: COMPLIANT
    conditionIndex:
      expected: 199
      actual: 199
    conditionText:
      expected: extract('CA10__blockPublicAcls__c') == 'Yes'
      actual: extract('CA10__blockPublicAcls__c') == 'Yes'
    runtimeError: {}
  - id: test3
    match: true
    status:
      expected: COMPLIANT
      actual: COMPLIANT
    conditionIndex:
      expected: 299
      actual: 299
    conditionText:
      expected: extract('CA10__accessControlGrants__c') == number(0.0)
      actual: extract('CA10__accessControlGrants__c') == number(0.0)
    runtimeError: {}
  - id: test4
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 399
      actual: 399
    conditionText:
      expected: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?permission==\\\
        'FULL_CONTROL\\' && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\\
        ' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\\
        ')])') > number(0.0)"
      actual: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?permission==\\\
        'FULL_CONTROL\\' && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\\
        ' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\\
        ')])') > number(0.0)"
    runtimeError: {}
  - id: test5
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 499
      actual: 499
    conditionText:
      expected: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\\
        'READ\\' || permission==\\'READ_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\\
        ' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\\
        ')])') > number(0.0) && extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\\
        'WRITE\\' || permission==\\'WRITE_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\\
        ' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\\
        ')])') > number(0.0)"
      actual: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\\
        'READ\\' || permission==\\'READ_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\\
        ' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\\
        ')])') > number(0.0) && extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\\
        'WRITE\\' || permission==\\'WRITE_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\\
        ' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\\
        ')])') > number(0.0)"
    runtimeError: {}
  - id: test6
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 599
      actual: 599
    conditionText:
      expected: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\\
        'READ\\' || permission==\\'READ_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\\
        ' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\\
        ')])') > number(0.0)"
      actual: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\\
        'READ\\' || permission==\\'READ_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\\
        ' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\\
        ')])') > number(0.0)"
    runtimeError: {}
  - id: test7
    match: true
    status:
      expected: COMPLIANT
      actual: COMPLIANT
    conditionIndex:
      expected: 700
      actual: 700
    conditionText:
      expected: otherwise
      actual: otherwise
    runtimeError: {}
  - id: test8
    match: true
    status:
      expected: UNDETERMINED
      actual: UNDETERMINED
    conditionIndex:
      expected: 301
      actual: 301
    conditionText:
      expected: CA10__accessControlPolicy__c.delegatedTo(CA10__accessControlPolicy__c).isEmpty()
      actual: CA10__accessControlPolicy__c.delegatedTo(CA10__accessControlPolicy__c).isEmpty()
    runtimeError: {}
  - id: test9
    match: true
    status:
      expected: COMPLIANT
      actual: COMPLIANT
    conditionIndex:
      expected: 700
      actual: 700
    conditionText:
      expected: otherwise
      actual: otherwise
    runtimeError: {}
  - id: test10
    match: true
    status:
      expected: UNDETERMINED
      actual: UNDETERMINED
    conditionIndex:
      expected: 304
      actual: 304
    conditionText:
      expected: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?permission==\\\
        'FULL_CONTROL\\' && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\\
        ' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\\
        ')])').isEvaluationFailed()"
      actual: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?permission==\\\
        'FULL_CONTROL\\' && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\\
        ' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\\
        ')])').isEvaluationFailed()"
    runtimeError:
      expected: "TypeError: length() expected argument 1 to be type 2,3,4 but received\
        \ type 7 instead."
      actual: "TypeError: length() expected argument 1 to be type 2,3,4 but received\
        \ type 7 instead."
usedFiles:
  - path: /ce/ca/aws/s3/bucket-public-acl/policy.yaml
    md5Hash: C6AFA22C41AF4DC7DB82BC21082DF822
    content: "---\nnames:\n  full: \"AWS S3 Bucket ACL allows public read or write\
      \ access\"\n  contextual: \"Bucket ACL allows public read or write access\"\n\
      description: >\n  S3 bucket ACLs should not grant public read or write access.\
      \ Granting permissions \n  to 'allUsers' (everyone on the internet) or 'allAuthenticatedUsers'\
      \ (any authenticated \n  AWS account) can lead to unintended data exposure.\n\
      type: \"COMPLIANCE_POLICY\"\ncategories:\n  - \"SECURITY\"\nframeworkMappings:\n\
      \  - \"/frameworks/cloudaware/resource-security/public-and-anonymous-access\"\
      \n  - \"/frameworks/aws-fsbp-v1.0.0/s3/02\"\n  - \"/frameworks/aws-fsbp-v1.0.0/s3/03\"\
      \n  - \"/frameworks/aws-well-architected/sec/08/04\"\nsimilarPolicies:\n  awsSecurityHub:\n\
      \    - name: \"[S3.2] S3 general purpose buckets should block public read access\"\
      \n      url: \"https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-2\"\
      \n    - name: \"[S3.3] S3 general purpose buckets should block public write\
      \ access\"\n      url: \"https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-3\""
  - path: /ce/ca/aws/s3/bucket-public-acl/prod.logic.yaml
    md5Hash: 88F6B3E1B3EED363C3A1C5CF1C420F67
    content: |
      ---
      inputType: "CA10__CaAwsBucket__c"
      testData:
        - file: "test-data.json"
      importExtracts:
        - file: "/types/CA10__CaAwsBucket__c/object.extracts.yaml"
      conditions:
        - status: "COMPLIANT"
          currentStateMessage: "The Bucket is configured to block public ACLs."
          check:
            IS_EQUAL:
              left:
                EXTRACT: CA10__blockPublicAcls__c
              right:
                TEXT: "Yes"
        - status: "COMPLIANT"
          currentStateMessage: "The Bucket ACL is configured with any grants."
          check:
            IS_EQUAL:
              left:
                EXTRACT: CA10__accessControlGrants__c
              right:
                NUMBER: 0.0
        - status: "INCOMPLIANT"
          currentStateMessage: "The bucket ACL grants public full control access."
          remediationMessage: "Modify the bucket ACL to remove grants for 'Everyone' or\
            \ 'Any authenticated AWS user'. It is strongly recommended to enable\
            \ 'Block all public access' and use IAM policies for access control."
          check:
            # Full control for Everyone or Any authenticated AWS user
            GREATER_THAN:
              left:
                JSON_QUERY_NUMBER:
                  arg:
                    EXTRACT: "caJsonFrom__accessControlPolicy__c"
                  expression: "length(grants[?permission=='FULL_CONTROL' && (grantee.identifier=='http://acs.amazonaws.com/groups/global/AllUsers' || grantee.identifier=='http://acs.amazonaws.com/groups/global/AuthenticatedUsers')])"
                  undeterminedIf:
                    evaluationError: "The JSON query has failed."
                    resultTypeMismatch: "The JSON query did not return a number type."
              right:
                NUMBER: 0.0
        - status: "INCOMPLIANT"
          currentStateMessage: "The bucket ACL grants both public read and public write access."
          remediationMessage: "Modify the bucket ACL to remove grants for 'Everyone' or\
            \ 'Any authenticated AWS user'. It is strongly recommended to enable\
            \ 'Block all public access' and use IAM policies for access control."
          check:
            AND:
              args:
                # Read permissions for Everyone or Any authenticated AWS user
                - GREATER_THAN:
                    left:
                      JSON_QUERY_NUMBER:
                        arg:
                          EXTRACT: "caJsonFrom__accessControlPolicy__c"
                        expression: "length(grants[?(permission=='READ' || permission=='READ_ACP') && (grantee.identifier=='http://acs.amazonaws.com/groups/global/AllUsers' || grantee.identifier=='http://acs.amazonaws.com/groups/global/AuthenticatedUsers')])"
                        undeterminedIf:
                          evaluationError: "The JSON query has failed."
                          resultTypeMismatch: "The JSON query did not return a number type."
                    right:
                      NUMBER: 0.0
                # Write permissions for Everyone or Any authenticated AWS user
                - GREATER_THAN:
                    left:
                      JSON_QUERY_NUMBER:
                        arg:
                          EXTRACT: "caJsonFrom__accessControlPolicy__c"
                        expression: "length(grants[?(permission=='WRITE' || permission=='WRITE_ACP') && (grantee.identifier=='http://acs.amazonaws.com/groups/global/AllUsers' || grantee.identifier=='http://acs.amazonaws.com/groups/global/AuthenticatedUsers')])"
                        undeterminedIf:
                          evaluationError: "The JSON query has failed."
                          resultTypeMismatch: "The JSON query did not return a number type."
                    right:
                      NUMBER: 0.0
        - status: "INCOMPLIANT"
          currentStateMessage: "The bucket ACL grants public read access."
          remediationMessage: "Modify the bucket ACL to remove grants for 'Everyone' or\
            \ 'Any authenticated AWS user'. It is strongly recommended to enable\
            \ 'Block all public access' and use IAM policies for access control."
          check:
            # Read permissions for Everyone or Any authenticated AWS user
             GREATER_THAN:
              left:
                JSON_QUERY_NUMBER:
                  arg:
                    EXTRACT: "caJsonFrom__accessControlPolicy__c"
                  expression: "length(grants[?(permission=='READ' || permission=='READ_ACP') && (grantee.identifier=='http://acs.amazonaws.com/groups/global/AllUsers' || grantee.identifier=='http://acs.amazonaws.com/groups/global/AuthenticatedUsers')])"
                  undeterminedIf:
                    evaluationError: "The JSON query has failed."
                    resultTypeMismatch: "The JSON query did not return a number type."
              right:
                NUMBER: 0.0
        - status: "INCOMPLIANT"
          currentStateMessage: "The bucket ACL grants public write access."
          remediationMessage: "Modify the bucket ACL to remove grants for 'Everyone' or\
            \ 'Any authenticated AWS user'. It is strongly recommended to enable\
            \ 'Block all public access' and use IAM policies for access control."
          check:
            # Read permissions for Everyone or Any authenticated AWS user
            GREATER_THAN:
              left:
                JSON_QUERY_NUMBER:
                  arg:
                    EXTRACT: "caJsonFrom__accessControlPolicy__c"
                  expression: "length(grants[?(permission=='WRITE' || permission=='WRITE_ACP') && (grantee.identifier=='http://acs.amazonaws.com/groups/global/AllUsers' || grantee.identifier=='http://acs.amazonaws.com/groups/global/AuthenticatedUsers')])"
                  undeterminedIf:
                    evaluationError: "The JSON query has failed."
                    resultTypeMismatch: "The JSON query did not return a number type."
              right:
                NUMBER: 0.0
      otherwise:
        status: "COMPLIANT"
        currentStateMessage: "The Bucket ACL does not grant public read or write access."
  - path: /ce/ca/aws/s3/bucket-public-acl/test-data.json
    md5Hash: 8570F95BB625296F1FE5E34E3B3E54CD
    content: |-
      [
          {
              "expectedResult": {
                  "status": "DISAPPEARED",
                  "conditionIndex": "99",
                  "conditionText": "isDisappeared(CA10__disappearanceTime__c)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2025-11-11T04:01:28Z"
              },
              "CA10__disappearanceTime__c": "2025-08-06T13:01:39Z",
              "CA10__blockPublicAcls__c": "Yes",
              "CA10__accessControlGrants__c": 1,
              "CA10__accessControlPolicy__c": "{\n\"grants\":[{\n\"grantee\":{\n\"groupName\":\"AuthenticatedUsers\",\n\"identifier\":\"http://acs.amazonaws.com/groups/global/AuthenticatedUsers\",\n\"typeIdentifier\":\"uri\"\n},\n\"permission\":\"WRITE_ACP\"\n}]}",
              "Id": "test1"
          },
          {
              "expectedResult": {
                  "status": "COMPLIANT",
                  "conditionIndex": "199",
                  "conditionText": "extract('CA10__blockPublicAcls__c') == 'Yes'",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2025-11-11T04:01:28Z"
              },
              "CA10__disappearanceTime__c": null,
              "CA10__blockPublicAcls__c": "Yes",
              "CA10__accessControlGrants__c": 1,
              "CA10__accessControlPolicy__c": "{\n\"grants\":[{\n\"grantee\":{\n\"groupName\":\"AuthenticatedUsers\",\n\"identifier\":\"http://acs.amazonaws.com/groups/global/AuthenticatedUsers\",\n\"typeIdentifier\":\"uri\"\n},\n\"permission\":\"WRITE_ACP\"\n}]}",
              "Id": "test2"
          },
          {
              "expectedResult": {
                  "status": "COMPLIANT",
                  "conditionIndex": "299",
                  "conditionText": "extract('CA10__accessControlGrants__c') == number(0.0)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2025-11-11T04:01:28Z"
              },
              "CA10__disappearanceTime__c": null,
              "CA10__blockPublicAcls__c": "No",
              "CA10__accessControlGrants__c": 0,
              "CA10__accessControlPolicy__c": "{\n\"requesterCharged\":false\n}",
              "Id": "test3"
          },
          {
              "expectedResult": {
                  "status": "INCOMPLIANT",
                  "conditionIndex": "399",
                  "conditionText": "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?permission==\\'FULL_CONTROL\\' && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])') > number(0.0)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2025-11-11T04:01:28Z"
              },
              "CA10__disappearanceTime__c": null,
              "CA10__blockPublicAcls__c": "No",
              "CA10__accessControlGrants__c": 8,
              "CA10__accessControlPolicy__c": "{\n\"grants\":[{\n\"grantee\":{\n\"groupName\":\"AuthenticatedUsers\",\n\"identifier\":\"http://acs.amazonaws.com/groups/global/AuthenticatedUsers\",\n\"typeIdentifier\":\"uri\"\n},\n\"permission\":\"FULL_CONTROL\"\n}]}",
              "Id": "test4"
          },
          {
              "expectedResult": {
                  "status": "INCOMPLIANT",
                  "conditionIndex": "499",
                  "conditionText": "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'READ\\' || permission==\\'READ_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])') > number(0.0) && extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'WRITE\\' || permission==\\'WRITE_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])') > number(0.0)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2025-11-11T04:01:28Z"
              },
              "CA10__disappearanceTime__c": null,
              "CA10__blockPublicAcls__c": "No",
              "CA10__accessControlGrants__c": 8,
              "CA10__accessControlPolicy__c": "{\n\"grants\":[{\n\"grantee\":{\n\"groupName\":\"AuthenticatedUsers\",\n\"identifier\":\"http://acs.amazonaws.com/groups/global/AuthenticatedUsers\",\n\"typeIdentifier\":\"uri\"\n},\n\"permission\":\"WRITE_ACP\"\n},{\n\"grantee\":{\n\"groupName\":\"AllUsers\",\n\"identifier\":\"http://acs.amazonaws.com/groups/global/AllUsers\",\n\"typeIdentifier\":\"uri\"\n},\n\"permission\":\"READ\"\n}]}",
              "Id": "test5"
          },
          {
              "expectedResult": {
                  "status": "INCOMPLIANT",
                  "conditionIndex": "599",
                  "conditionText": "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'READ\\' || permission==\\'READ_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])') > number(0.0)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2025-11-11T04:01:28Z"
              },
              "CA10__disappearanceTime__c": null,
              "CA10__blockPublicAcls__c": "No",
              "CA10__accessControlGrants__c": 5,
              "CA10__accessControlPolicy__c": "{\n  \"grants\" : [ {\n    \"grantee\" : {\n      \"identifier\" : \"identifier\",\n      \"typeIdentifier\" : \"id\"\n    },\n    \"permission\" : \"READ\"\n  }, {\n    \"grantee\" : {\n      \"displayName\" : \"244029740462\",\n      \"identifier\" : \"3e1543c4d95b52de555636d38ac41ecb78c8e3f1f4bd2a600c36148a2b430749\",\n      \"typeIdentifier\" : \"id\"\n    },\n    \"permission\" : \"WRITE\"\n  }, {\n    \"grantee\" : {\n      \"displayName\" : \"244029740462\",\n      \"identifier\" : \"3e1543c4d95b52de555636d38ac41ecb78c8e3f1f4bd2a600c36148a2b430749\",\n      \"typeIdentifier\" : \"id\"\n    },\n    \"permission\" : \"READ_ACP\"\n  }, {\n    \"grantee\" : {\n      \"identifier\" : \"3e1543c4d95b52de555636d38ac41ecb78c8e3f1f4bd2a600c36148a2b430749\",\n      \"typeIdentifier\" : \"id\"\n    },\n    \"permission\" : \"WRITE_ACP\"\n  }, {\n    \"grantee\" : {\n      \"groupName\" : \"AllUsers\",\n      \"identifier\" : \"http://acs.amazonaws.com/groups/global/AllUsers\",\n      \"typeIdentifier\" : \"uri\"\n    },\n    \"permission\" : \"READ\"\n  } ],\n  \"requesterCharged\" : false\n}",
              "Id": "test6"
          },
          {
              "expectedResult": {
                  "status": "COMPLIANT",
                  "conditionIndex": "700",
                  "conditionText": "otherwise",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2025-11-11T04:01:28Z"
              },
              "CA10__disappearanceTime__c": null,
              "CA10__blockPublicAcls__c": "No",
              "CA10__accessControlGrants__c": 1,
              "CA10__accessControlPolicy__c": "{\n\"grants\":[{\n\"grantee\":{\n\"identifier\":\"identifier\",\n\"typeIdentifier\":\"id\"\n},\n\"permission\":\"FULL_CONTROL\"\n}]}",
              "Id": "test7"
          },
          {
              "expectedResult": {
                  "status": "UNDETERMINED",
                  "conditionIndex": "301",
                  "conditionText": "CA10__accessControlPolicy__c.delegatedTo(CA10__accessControlPolicy__c).isEmpty()",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2025-11-11T04:01:28Z"
              },
              "CA10__disappearanceTime__c": null,
              "CA10__blockPublicAcls__c": "No",
              "CA10__accessControlGrants__c": 1,
              "CA10__accessControlPolicy__c": "",
              "Id": "test8"
          },
          {
              "expectedResult": {
                  "status": "COMPLIANT",
                  "conditionIndex": "700",
                  "conditionText": "otherwise",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2025-11-11T04:01:28Z"
              },
              "CA10__disappearanceTime__c": null,
              "CA10__blockPublicAcls__c": "No",
              "CA10__accessControlGrants__c": 1,
              "CA10__accessControlPolicy__c": "{\n\"grants\":[]}",
              "Id": "test9"
          },
          {
              "expectedResult": {
                  "status": "UNDETERMINED",
                  "conditionIndex": "304",
                  "conditionText": "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?permission==\\'FULL_CONTROL\\' && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])').isEvaluationFailed()",
                  "runtimeError": "TypeError: length() expected argument 1 to be type 2,3,4 but received type 7 instead."
              },
              "context": {
                  "snapshotTime": "2025-11-11T04:01:28Z"
              },
              "CA10__disappearanceTime__c": null,
              "CA10__blockPublicAcls__c": "No",
              "CA10__accessControlGrants__c": 1,
              "CA10__accessControlPolicy__c": "{}",
              "Id": "test10"
          }
      ]
  - path: /types/CA10__CaAwsBucket__c/object.extracts.yaml
    md5Hash: F56AFA293B0B19D4F39C1EBB70F4C56F
    content: "---\nextracts:\n# Values: yes, no. Not Nullable.\n  - name: \"CA10__objectLockEnabled__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10__objectLockEnabled__c\"\n\
      \        undeterminedIf:\n          noAccessDelegate:\n            path: \"\
      CA10__objectLockEnabled__c\"\n            currentStateMessage: \"Unable to determine\
      \ Object Lock status. Possible permission issue with s3:GetObjectLockConfiguration\"\
      \n          isEmpty: \"Object Lock status is not populated yet\"\n# Nullable.\n\
      \  - name: \"CA10__lifecycleRulesJson__c\"\n    value: \n      FIELD:\n    \
      \    path: \"CA10__lifecycleRulesJson__c\"\n        returnType: BYTES\n    \
      \    # undeterminedIf:\n        #   noAccessDelegate:\n        #     path: \"\
      CA10__lifecycleRulesJson__c\"\n        #     currentStateMessage: \"Unable to\
      \ determine Lifecycle Configuration. Possible permission issue with s3:GetLifecycleConfiguration\"\
      \n# Values: enabled, suspended, off. Not Nullable.\n  - name: \"CA10__versioningStatus__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10__versioningStatus__c\"\n \
      \       undeterminedIf:\n          noAccessDelegate:\n            path: \"CA10__versioningStatus__c\"\
      \n            currentStateMessage: \"Unable to determine versioning status.\
      \ Possible permission issue with s3:GetBucketVersioning\"\n          isEmpty:\
      \ \"Status is not populated yet\"\n# Checkbox.\n  - name: \"CA10__versioningMfaDeleteEnabled__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10__versioningMfaDeleteEnabled__c\"\
      \n        undeterminedIf:\n          noAccessDelegate:\n            path: \"\
      CA10__versioningStatus__c\"\n            currentStateMessage: \"Unable to determine\
      \ versioning status. Possible permission issue with s3:GetBucketVersioning\"\
      \n# The field can be empty if server access logging is not enabled\n  - name:\
      \ \"CA10__loggingDestinationBucketName__c\"\n    value: \n      FIELD:\n   \
      \     path: \"CA10__loggingDestinationBucketName__c\"\n        # undeterminedIf:\n\
      \        #   noAccessDelegate:\n        #     path: \"CA10__loggingDestinationBucketName__c\"\
      \n        #     currentStateMessage: \"Unable to determine if server access\
      \ logging is enabled. Possible permission issue with s3:GetBucketLogging\"\n\
      # Cloudaware derives this field from CA10__loggingDestinationBucketName__c\n\
      \  - name: \"CA10__loggingDestinationBucketArn__c\"\n    value: \n      FIELD:\n\
      \        path: \"CA10__loggingDestinationBucketArn__c\"\n        undeterminedIf:\n\
      \          noAccessDelegate:\n            path: \"CA10__loggingDestinationBucketName__c\"\
      \n            currentStateMessage: \"Unable to determine if server access logging\
      \ is enabled. Possible permission issue with s3:GetBucketLogging\"\n# This is\
      \ a look up on CA10__CaAwsBucket__c derived from CA10__loggingDestinationBucketName__c\n\
      \  - name: \"CA10__loggingDestinationBucket__c\"\n    value: \n      FIELD:\n\
      \        path: \"CA10__loggingDestinationBucket__c\"\n        undeterminedIf:\n\
      \          noAccessDelegate:\n            path: \"CA10__loggingDestinationBucketName__c\"\
      \n            currentStateMessage: \"Unable to determine if server access logging\
      \ is enabled. Possible permission issue with s3:GetBucketLogging\"\n  - name:\
      \ \"CA10__arn__c\"\n    value: \n      FIELD:\n        path: \"CA10__arn__c\"\
      \n        undeterminedIf:\n          isEmpty: \"Bucket ARN cannot be empty.\
      \ Potential data corruption\"\n  - name: \"caJsonFrom__lifecycleRulesJson__c\"\
      \n    value: \n      JSON_FROM:\n        arg: \n          EXTRACT: \"CA10__lifecycleRulesJson__c\"\
      \n        undeterminedIf:\n          isInvalid: \"S3 Bucket Lifecycle Rules\
      \ JSON is invalid.\"\n# Returns BOOLEAN true if number of enabled lifecycle\
      \ rules more than 0 otherwise returns false\n  - name: \"caJsonBoolean__lifecycleRulesJsonStatusEnabled__c\"\
      \n    value: \n      JSON_QUERY_BOOLEAN:\n        arg: \n          EXTRACT:\
      \ \"caJsonFrom__lifecycleRulesJson__c\"\n        expression: \"length([?status=='Enabled'])\
      \ > `0`\"\n        undeterminedIf: \n          evaluationError: \"The JSON query\
      \ has failed.\"\n          resultTypeMismatch: \"The JSON query did not return\
      \ a boolean.\"\n  - name: \"CA10__blockPublicAcls__c\"\n    value: \n      FIELD:\n\
      \        path: \"CA10__blockPublicAcls__c\"\n        undeterminedIf:\n     \
      \     noAccessDelegate:\n            path: \"CA10__blockPublicAcls__c\"\n  \
      \          currentStateMessage: \"Unable to determine the bucket policy. Possible\
      \ permission issue with s3:GetBucketPublicAccessBlock\"\n  - name: \"CA10__blockPublicPolicy__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10__blockPublicPolicy__c\"\n\
      \        undeterminedIf:\n          noAccessDelegate:\n            path: \"\
      CA10__blockPublicPolicy__c\"\n            currentStateMessage: \"Unable to determine\
      \ the bucket policy. Possible permission issue with s3:GetBucketPublicAccessBlock\"\
      \n  - name: \"CA10__ignorePublicAcls__c\"\n    value: \n      FIELD:\n     \
      \   path: \"CA10__ignorePublicAcls__c\"\n        undeterminedIf:\n         \
      \ noAccessDelegate:\n            path: \"CA10__ignorePublicAcls__c\"\n     \
      \       currentStateMessage: \"Unable to determine the bucket policy. Possible\
      \ permission issue with s3:GetBucketPublicAccessBlock\"\n  - name: \"CA10__restrictPublicBuckets__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10__restrictPublicBuckets__c\"\
      \n        undeterminedIf:\n          noAccessDelegate:\n            path: \"\
      CA10__restrictPublicBuckets__c\"\n            currentStateMessage: \"Unable\
      \ to determine the bucket policy. Possible permission issue with s3:GetBucketPublicAccessBlock\"\
      \n# Nullable.\n  - name: \"CA10__policyDocument__c\"\n    value: \n      FIELD:\n\
      \        path: \"CA10__policyDocument__c\"\n        returnType: BYTES\n    \
      \    # undeterminedIf:\n        #   noAccessDelegate:\n        #     path: \"\
      CA10__policyDocument__c\"\n        #     currentStateMessage: \"Unable to determine\
      \ the bucket policy. Possible permission issue with s3:GetBucketPolicy\"\n \
      \ - name: \"caJsonFrom__policyDocument__c\"\n    value: \n      JSON_FROM:\n\
      \        arg: \n          EXTRACT: \"CA10__policyDocument__c\"\n        undeterminedIf:\n\
      \          isInvalid: \"S3 Bucket Policy Document JSON is invalid.\"\n# Nullable.\n\
      \  - name: \"CA10__intelligentTieringConfigurationsJson__c\"\n    value: \n\
      \      FIELD:\n        path: \"CA10__intelligentTieringConfigurationsJson__c\"\
      \n        returnType: BYTES\n  - name: \"caJsonFrom__intelligentTieringConfigurationsJson__c\"\
      \n    value: \n      JSON_FROM:\n        arg: \n          EXTRACT: \"CA10__intelligentTieringConfigurationsJson__c\"\
      \n        undeterminedIf:\n          isInvalid: \"S3 Bucket Policy Document\
      \ JSON is invalid.\"\n# Nullable.\n  - name: \"CA10__regionName__c\"\n    value:\n\
      \      FIELD:\n        path: \"CA10__regionName__c\"\n# Nullable.\n  - name:\
      \ \"CA10__intelligentTieringStorageGb__c\"\n    value:\n      FIELD:\n     \
      \   path: \"CA10__intelligentTieringStorageGb__c\"\n# Values: AES256 | aws:fsx\
      \ | aws:kms | aws:kms:dsse | None. Not Nullable.\n  - name: \"CA10__serverSideEncryptionAlgorithm__c\"\
      \n    value:\n      FIELD:\n        path: \"CA10__serverSideEncryptionAlgorithm__c\"\
      \n        undeterminedIf:\n          noAccessDelegate:\n            path: \"\
      CA10__serverSideEncryptionAlgorithm__c\"\n            currentStateMessage: \"\
      Unable to determine Bucket Encryption Algorithm. Possible permissions issue\
      \ with s3:GetEncryptionConfiguration\"\n  - name: \"CA10__accessControlPolicy__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10__accessControlPolicy__c\"\n\
      \        undeterminedIf:\n          noAccessDelegate:\n            path: \"\
      CA10__accessControlPolicy__c\"\n            currentStateMessage: \"Unable to\
      \ determine the bucket ACL. Possible permission issue with s3:GetBucketAcl\"\
      \n  - name: \"caJsonFrom__accessControlPolicy__c\"\n    value: \n      JSON_FROM:\n\
      \        arg:\n          EXTRACT: \"CA10__accessControlPolicy__c\"\n       \
      \ undeterminedIf:\n          isInvalid: \"The Access Control Policy JSON is\
      \ invalid.\"\n  - name: \"CA10__accessControlGrants__c\"\n    value: \n    \
      \  FIELD:\n        path: \"CA10__accessControlGrants__c\"\n        undeterminedIf:\n\
      \          noAccessDelegate:\n            path: \"CA10__accessControlGrants__c\"\
      \n            currentStateMessage: \"Unable to determine the bucket ACL. Possible\
      \ permission issue with s3:GetBucketAcl\"\n  - name: \"CA10__policyIsPublic__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10__policyIsPublic__c\"\n   \
      \     undeterminedIf:\n          noAccessDelegate:\n            path: \"CA10__policyIsPublic__c\"\
      \n            currentStateMessage: \"Unable to determine the bucket policy status.\
      \ Possible permission issue with s3:GetBucketPolicyStatus\"\n"
script: |-
  CREATE TEMP FUNCTION mock_ExpectedResult()
  RETURNS ARRAY<STRUCT<
          Id STRING,
          expectedResult STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, runtimeError STRING>
      >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "Id" : "test1",
    "expectedResult" : {
      "status" : "DISAPPEARED",
      "conditionIndex" : "99",
      "conditionText" : "isDisappeared(CA10__disappearanceTime__c)",
      "runtimeError" : null
    }
  }, {
    "Id" : "test2",
    "expectedResult" : {
      "status" : "COMPLIANT",
      "conditionIndex" : "199",
      "conditionText" : "extract('CA10__blockPublicAcls__c') == 'Yes'",
      "runtimeError" : null
    }
  }, {
    "Id" : "test3",
    "expectedResult" : {
      "status" : "COMPLIANT",
      "conditionIndex" : "299",
      "conditionText" : "extract('CA10__accessControlGrants__c') == number(0.0)",
      "runtimeError" : null
    }
  }, {
    "Id" : "test4",
    "expectedResult" : {
      "status" : "INCOMPLIANT",
      "conditionIndex" : "399",
      "conditionText" : "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?permission==\\'FULL_CONTROL\\' && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])') > number(0.0)",
      "runtimeError" : null
    }
  }, {
    "Id" : "test5",
    "expectedResult" : {
      "status" : "INCOMPLIANT",
      "conditionIndex" : "499",
      "conditionText" : "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'READ\\' || permission==\\'READ_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])') > number(0.0) && extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'WRITE\\' || permission==\\'WRITE_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])') > number(0.0)",
      "runtimeError" : null
    }
  }, {
    "Id" : "test6",
    "expectedResult" : {
      "status" : "INCOMPLIANT",
      "conditionIndex" : "599",
      "conditionText" : "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'READ\\' || permission==\\'READ_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])') > number(0.0)",
      "runtimeError" : null
    }
  }, {
    "Id" : "test7",
    "expectedResult" : {
      "status" : "COMPLIANT",
      "conditionIndex" : "700",
      "conditionText" : "otherwise",
      "runtimeError" : null
    }
  }, {
    "Id" : "test8",
    "expectedResult" : {
      "status" : "UNDETERMINED",
      "conditionIndex" : "301",
      "conditionText" : "CA10__accessControlPolicy__c.delegatedTo(CA10__accessControlPolicy__c).isEmpty()",
      "runtimeError" : null
    }
  }, {
    "Id" : "test9",
    "expectedResult" : {
      "status" : "COMPLIANT",
      "conditionIndex" : "700",
      "conditionText" : "otherwise",
      "runtimeError" : null
    }
  }, {
    "Id" : "test10",
    "expectedResult" : {
      "status" : "UNDETERMINED",
      "conditionIndex" : "304",
      "conditionText" : "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?permission==\\'FULL_CONTROL\\' && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])').isEvaluationFailed()",
      "runtimeError" : "TypeError: length() expected argument 1 to be type 2,3,4 but received type 7 instead."
    }
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaAwsBucket__c()
  RETURNS ARRAY<STRUCT<
      CA10__disappearanceTime__c TIMESTAMP,
      CA10__blockPublicAcls__c STRING,
      CA10__accessControlGrants__c FLOAT64,
      CA10__accessControlPolicy__c STRING,
      Id STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2025-11-11T04:01:28Z")
    },
    "CA10__disappearanceTime__c" : new Date("2025-08-06T13:01:39Z"),
    "CA10__blockPublicAcls__c" : "Yes",
    "CA10__accessControlGrants__c" : 1,
    "CA10__accessControlPolicy__c" : "{\n\"grants\":[{\n\"grantee\":{\n\"groupName\":\"AuthenticatedUsers\",\n\"identifier\":\"http://acs.amazonaws.com/groups/global/AuthenticatedUsers\",\n\"typeIdentifier\":\"uri\"\n},\n\"permission\":\"WRITE_ACP\"\n}]}",
    "Id" : "test1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-11-11T04:01:28Z")
    },
    "CA10__blockPublicAcls__c" : "Yes",
    "CA10__accessControlGrants__c" : 1,
    "CA10__accessControlPolicy__c" : "{\n\"grants\":[{\n\"grantee\":{\n\"groupName\":\"AuthenticatedUsers\",\n\"identifier\":\"http://acs.amazonaws.com/groups/global/AuthenticatedUsers\",\n\"typeIdentifier\":\"uri\"\n},\n\"permission\":\"WRITE_ACP\"\n}]}",
    "Id" : "test2"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-11-11T04:01:28Z")
    },
    "CA10__blockPublicAcls__c" : "No",
    "CA10__accessControlGrants__c" : 0,
    "CA10__accessControlPolicy__c" : "{\n\"requesterCharged\":false\n}",
    "Id" : "test3"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-11-11T04:01:28Z")
    },
    "CA10__blockPublicAcls__c" : "No",
    "CA10__accessControlGrants__c" : 8,
    "CA10__accessControlPolicy__c" : "{\n\"grants\":[{\n\"grantee\":{\n\"groupName\":\"AuthenticatedUsers\",\n\"identifier\":\"http://acs.amazonaws.com/groups/global/AuthenticatedUsers\",\n\"typeIdentifier\":\"uri\"\n},\n\"permission\":\"FULL_CONTROL\"\n}]}",
    "Id" : "test4"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-11-11T04:01:28Z")
    },
    "CA10__blockPublicAcls__c" : "No",
    "CA10__accessControlGrants__c" : 8,
    "CA10__accessControlPolicy__c" : "{\n\"grants\":[{\n\"grantee\":{\n\"groupName\":\"AuthenticatedUsers\",\n\"identifier\":\"http://acs.amazonaws.com/groups/global/AuthenticatedUsers\",\n\"typeIdentifier\":\"uri\"\n},\n\"permission\":\"WRITE_ACP\"\n},{\n\"grantee\":{\n\"groupName\":\"AllUsers\",\n\"identifier\":\"http://acs.amazonaws.com/groups/global/AllUsers\",\n\"typeIdentifier\":\"uri\"\n},\n\"permission\":\"READ\"\n}]}",
    "Id" : "test5"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-11-11T04:01:28Z")
    },
    "CA10__blockPublicAcls__c" : "No",
    "CA10__accessControlGrants__c" : 5,
    "CA10__accessControlPolicy__c" : "{\n  \"grants\" : [ {\n    \"grantee\" : {\n      \"identifier\" : \"identifier\",\n      \"typeIdentifier\" : \"id\"\n    },\n    \"permission\" : \"READ\"\n  }, {\n    \"grantee\" : {\n      \"displayName\" : \"244029740462\",\n      \"identifier\" : \"3e1543c4d95b52de555636d38ac41ecb78c8e3f1f4bd2a600c36148a2b430749\",\n      \"typeIdentifier\" : \"id\"\n    },\n    \"permission\" : \"WRITE\"\n  }, {\n    \"grantee\" : {\n      \"displayName\" : \"244029740462\",\n      \"identifier\" : \"3e1543c4d95b52de555636d38ac41ecb78c8e3f1f4bd2a600c36148a2b430749\",\n      \"typeIdentifier\" : \"id\"\n    },\n    \"permission\" : \"READ_ACP\"\n  }, {\n    \"grantee\" : {\n      \"identifier\" : \"3e1543c4d95b52de555636d38ac41ecb78c8e3f1f4bd2a600c36148a2b430749\",\n      \"typeIdentifier\" : \"id\"\n    },\n    \"permission\" : \"WRITE_ACP\"\n  }, {\n    \"grantee\" : {\n      \"groupName\" : \"AllUsers\",\n      \"identifier\" : \"http://acs.amazonaws.com/groups/global/AllUsers\",\n      \"typeIdentifier\" : \"uri\"\n    },\n    \"permission\" : \"READ\"\n  } ],\n  \"requesterCharged\" : false\n}",
    "Id" : "test6"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-11-11T04:01:28Z")
    },
    "CA10__blockPublicAcls__c" : "No",
    "CA10__accessControlGrants__c" : 1,
    "CA10__accessControlPolicy__c" : "{\n\"grants\":[{\n\"grantee\":{\n\"identifier\":\"identifier\",\n\"typeIdentifier\":\"id\"\n},\n\"permission\":\"FULL_CONTROL\"\n}]}",
    "Id" : "test7"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-11-11T04:01:28Z")
    },
    "CA10__blockPublicAcls__c" : "No",
    "CA10__accessControlGrants__c" : 1,
    "CA10__accessControlPolicy__c" : "",
    "Id" : "test8"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-11-11T04:01:28Z")
    },
    "CA10__blockPublicAcls__c" : "No",
    "CA10__accessControlGrants__c" : 1,
    "CA10__accessControlPolicy__c" : "{\n\"grants\":[]}",
    "Id" : "test9"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-11-11T04:01:28Z")
    },
    "CA10__blockPublicAcls__c" : "No",
    "CA10__accessControlGrants__c" : 1,
    "CA10__accessControlPolicy__c" : "{}",
    "Id" : "test10"
  } ];
  """;

  CREATE TEMP FUNCTION process_CA10__CaAwsBucket__c(
      obj STRUCT<
          CA10__disappearanceTime__c TIMESTAMP,
          CA10__blockPublicAcls__c STRING,
          CA10__accessControlGrants__c FLOAT64,
          CA10__accessControlPolicy__c STRING,
          Id STRING
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  OPTIONS (library=['gs://compliance-platform-public/jmespath.min.js'])
  AS r"""
  var TextLib = new function () {
      this.normalize = function(arg) {
          return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase();
      };
      this.isEmpty = function(arg) {
          return this.normalize(arg) == '';
      };
      this.isNotEmpty = function(arg) {
          return this.normalize(arg) != '';
      };
      this.equal = function(left, right) {
          return this.normalize(left) == this.normalize(right);
      };
      this.notEqual = function(left, right) {
          return this.normalize(left) != this.normalize(right);
      };
      this.startsWith = function(arg, substring) {
          return this.normalize(arg).startsWith(this.normalize(substring));
      };
      this.endsWith = function(arg, substring) {
          return this.normalize(arg).endsWith(this.normalize(substring));
      };
      this.contains = function(arg, substring) {
          return this.normalize(arg).includes(this.normalize(substring));
      };
      this.containsAll = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.every(sub => normalizedArg.includes(this.normalize(sub)));
      };
      this.containsAny = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.some(sub => normalizedArg.includes(this.normalize(sub)));
      };
  }();
  var BytesLib = new function () {
      this.normalize = function(arg) {
          return arg == null ? '' : arg;
      };
      this.isEmpty = function(arg) {
          return this.normalize(arg) == '';
      };
      this.isNotEmpty = function(arg) {
          return this.normalize(arg) != '';
      };
      this.equal = function(left, right) {
          return this.normalize(left) == this.normalize(right);
      };
      this.notEqual = function(left, right) {
          return this.normalize(left) != this.normalize(right);
      };
      this.startsWith = function(arg, substring) {
          return this.normalize(arg).startsWith(this.normalize(substring));
      };
      this.endsWith = function(arg, substring) {
          return this.normalize(arg).endsWith(this.normalize(substring));
      };
      this.contains = function(arg, substring) {
          return this.normalize(arg).includes(this.normalize(substring));
      };
      this.containsAll = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.every(sub => normalizedArg.includes(this.normalize(sub)));
      };
      this.containsAny = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.some(sub => normalizedArg.includes(this.normalize(sub)));
      };
  }();
  var IsEmptyLib = new function () {
      this.simpleIsEmpty = function(arg) {
          return arg == null;
      };
      this.simpleIsNotEmpty = function(arg) {
          return arg != null;
      };
  }();
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c);
      if (obj.CA10__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[1], conditionIndex:[100..199]
      function fieldChecked4() {
          if (TextLib.isEmpty(obj.CA10__blockPublicAcls__c)) {
              throw new Error("UNDETERMINED condition:101", {cause: {status: 'UNDETERMINED', conditionIndex: 101, conditionText: "CA10__blockPublicAcls__c.delegatedTo(CA10__blockPublicAcls__c).isEmpty()", currentStateMessage: "Unable to determine the bucket policy. Possible permission issue with s3:GetBucketPublicAccessBlock", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          return obj.CA10__blockPublicAcls__c;
      }
      function extract3() { if (!this.out) { this.out = fieldChecked4(); } return this.out; };
      references1.push('Block Public ACLs [obj.CA10__blockPublicAcls__c]: ' + obj.CA10__blockPublicAcls__c);
      try {
          if (TextLib.equal(extract3.call(extract3), 'Yes')) {
              return {status: 'COMPLIANT', conditionIndex: 199, conditionText: "extract('CA10__blockPublicAcls__c') == 'Yes'", currentStateMessage: "The Bucket is configured to block public ACLs.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
          }
      } catch (err) {
          if (err.cause && err.cause.status) { return err.cause; } else { throw err; }
      }
      // condition[2], conditionIndex:[200..299]
      function fieldChecked7() {
          if (IsEmptyLib.simpleIsEmpty(obj.CA10__accessControlGrants__c)) {
              throw new Error("UNDETERMINED condition:201", {cause: {status: 'UNDETERMINED', conditionIndex: 201, conditionText: "CA10__accessControlGrants__c.delegatedTo(CA10__accessControlGrants__c).isEmpty()", currentStateMessage: "Unable to determine the bucket ACL. Possible permission issue with s3:GetBucketAcl", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          return obj.CA10__accessControlGrants__c;
      }
      function extract6() { if (!this.out) { this.out = fieldChecked7(); } return this.out; };
      references1.push('Access Control Grants [obj.CA10__accessControlGrants__c]: ' + obj.CA10__accessControlGrants__c);
      try {
          if (extract6.call(extract6) == 0.0) {
              return {status: 'COMPLIANT', conditionIndex: 299, conditionText: "extract('CA10__accessControlGrants__c') == number(0.0)", currentStateMessage: "The Bucket ACL is configured with any grants.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
          }
      } catch (err) {
          if (err.cause && err.cause.status) { return err.cause; } else { throw err; }
      }
      // condition[3], conditionIndex:[300..399]
      function comparison8() {
          var comparisonLeft16 = jsonQueryChecked9();
          return comparisonLeft16 != null && 0.0 != null && comparisonLeft16 > 0.0;
      }
      function jsonQueryChecked9() {
          var input = extract11.call(extract11);
          var out;
          try {
              out = jmespath.search(input, 'length(grants[?permission==\'FULL_CONTROL\' && (grantee.identifier==\'http://acs.amazonaws.com/groups/global/AllUsers\' || grantee.identifier==\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\')])');
          if (out != null && typeof out != 'number') {
              throw new Error("UNDETERMINED condition:303", {cause: {status: 'UNDETERMINED', conditionIndex: 303, conditionText: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?permission==\\'FULL_CONTROL\\' && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])').isResultTypeMismatch()", currentStateMessage: "The JSON query did not return a number type.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          } catch (e) {
              throw new Error("UNDETERMINED condition:304", {cause: {status: 'UNDETERMINED', conditionIndex: 304, conditionText: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?permission==\\'FULL_CONTROL\\' && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])').isEvaluationFailed()", currentStateMessage: "The JSON query has failed.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: e.message}});
          }
          return out;
      }
      function jsonChecked12() {
          var input = extract14.call(extract14);
          input = TextLib.isEmpty(input) ? null : input;
          var out;
          try {
              out = JSON.parse(input);
          } catch (e) {
              throw new Error("UNDETERMINED condition:302", {cause: {status: 'UNDETERMINED', conditionIndex: 302, conditionText: "extract('CA10__accessControlPolicy__c').asJson().isInvalid()", currentStateMessage: "The Access Control Policy JSON is invalid.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: e.message}});
          }
          return out;
      }
      function fieldChecked15() {
          if (BytesLib.isEmpty(obj.CA10__accessControlPolicy__c)) {
              throw new Error("UNDETERMINED condition:301", {cause: {status: 'UNDETERMINED', conditionIndex: 301, conditionText: "CA10__accessControlPolicy__c.delegatedTo(CA10__accessControlPolicy__c).isEmpty()", currentStateMessage: "Unable to determine the bucket ACL. Possible permission issue with s3:GetBucketAcl", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          return obj.CA10__accessControlPolicy__c;
      }
      function extract14() { if (!this.out) { this.out = fieldChecked15(); } return this.out; };
      function extract11() { if (!this.out) { this.out = jsonChecked12(); } return this.out; };
      references1.push('Access Control Policy [obj.CA10__accessControlPolicy__c]: ' + obj.CA10__accessControlPolicy__c);
      try {
          if (comparison8()) {
              return {status: 'INCOMPLIANT', conditionIndex: 399, conditionText: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?permission==\\'FULL_CONTROL\\' && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])') > number(0.0)", currentStateMessage: "The bucket ACL grants public full control access.", currentStateReferences: references1.join('\n'), remediation: "Modify the bucket ACL to remove grants for 'Everyone' or 'Any authenticated AWS user'. It is strongly recommended to enable 'Block all public access' and use IAM policies for access control.", runtimeError: null};
          }
      } catch (err) {
          if (err.cause && err.cause.status) { return err.cause; } else { throw err; }
      }
      // condition[4], conditionIndex:[400..499]
      function comparison17() {
          var comparisonLeft25 = jsonQueryChecked18();
          return comparisonLeft25 != null && 0.0 != null && comparisonLeft25 > 0.0;
      }
      function jsonQueryChecked18() {
          var input = extract20.call(extract20);
          var out;
          try {
              out = jmespath.search(input, 'length(grants[?(permission==\'READ\' || permission==\'READ_ACP\') && (grantee.identifier==\'http://acs.amazonaws.com/groups/global/AllUsers\' || grantee.identifier==\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\')])');
          if (out != null && typeof out != 'number') {
              throw new Error("UNDETERMINED condition:403", {cause: {status: 'UNDETERMINED', conditionIndex: 403, conditionText: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'READ\\' || permission==\\'READ_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])').isResultTypeMismatch()", currentStateMessage: "The JSON query did not return a number type.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          } catch (e) {
              throw new Error("UNDETERMINED condition:404", {cause: {status: 'UNDETERMINED', conditionIndex: 404, conditionText: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'READ\\' || permission==\\'READ_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])').isEvaluationFailed()", currentStateMessage: "The JSON query has failed.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: e.message}});
          }
          return out;
      }
      function jsonChecked21() {
          var input = extract23.call(extract23);
          input = TextLib.isEmpty(input) ? null : input;
          var out;
          try {
              out = JSON.parse(input);
          } catch (e) {
              throw new Error("UNDETERMINED condition:402", {cause: {status: 'UNDETERMINED', conditionIndex: 402, conditionText: "extract('CA10__accessControlPolicy__c').asJson().isInvalid()", currentStateMessage: "The Access Control Policy JSON is invalid.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: e.message}});
          }
          return out;
      }
      function fieldChecked24() {
          if (BytesLib.isEmpty(obj.CA10__accessControlPolicy__c)) {
              throw new Error("UNDETERMINED condition:401", {cause: {status: 'UNDETERMINED', conditionIndex: 401, conditionText: "CA10__accessControlPolicy__c.delegatedTo(CA10__accessControlPolicy__c).isEmpty()", currentStateMessage: "Unable to determine the bucket ACL. Possible permission issue with s3:GetBucketAcl", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          return obj.CA10__accessControlPolicy__c;
      }
      function extract23() { if (!this.out) { this.out = fieldChecked24(); } return this.out; };
      function extract20() { if (!this.out) { this.out = jsonChecked21(); } return this.out; };
      function comparison26() {
          var comparisonLeft29 = jsonQueryChecked27();
          return comparisonLeft29 != null && 0.0 != null && comparisonLeft29 > 0.0;
      }
      function jsonQueryChecked27() {
          var input = extract20.call(extract20);
          var out;
          try {
              out = jmespath.search(input, 'length(grants[?(permission==\'WRITE\' || permission==\'WRITE_ACP\') && (grantee.identifier==\'http://acs.amazonaws.com/groups/global/AllUsers\' || grantee.identifier==\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\')])');
          if (out != null && typeof out != 'number') {
              throw new Error("UNDETERMINED condition:405", {cause: {status: 'UNDETERMINED', conditionIndex: 405, conditionText: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'WRITE\\' || permission==\\'WRITE_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])').isResultTypeMismatch()", currentStateMessage: "The JSON query did not return a number type.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          } catch (e) {
              throw new Error("UNDETERMINED condition:406", {cause: {status: 'UNDETERMINED', conditionIndex: 406, conditionText: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'WRITE\\' || permission==\\'WRITE_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])').isEvaluationFailed()", currentStateMessage: "The JSON query has failed.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: e.message}});
          }
          return out;
      }
      try {
          if (comparison17() && comparison26()) {
              return {status: 'INCOMPLIANT', conditionIndex: 499, conditionText: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'READ\\' || permission==\\'READ_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])') > number(0.0) && extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'WRITE\\' || permission==\\'WRITE_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])') > number(0.0)", currentStateMessage: "The bucket ACL grants both public read and public write access.", currentStateReferences: references1.join('\n'), remediation: "Modify the bucket ACL to remove grants for 'Everyone' or 'Any authenticated AWS user'. It is strongly recommended to enable 'Block all public access' and use IAM policies for access control.", runtimeError: null};
          }
      } catch (err) {
          if (err.cause && err.cause.status) { return err.cause; } else { throw err; }
      }
      // condition[5], conditionIndex:[500..599]
      function comparison30() {
          var comparisonLeft38 = jsonQueryChecked31();
          return comparisonLeft38 != null && 0.0 != null && comparisonLeft38 > 0.0;
      }
      function jsonQueryChecked31() {
          var input = extract33.call(extract33);
          var out;
          try {
              out = jmespath.search(input, 'length(grants[?(permission==\'READ\' || permission==\'READ_ACP\') && (grantee.identifier==\'http://acs.amazonaws.com/groups/global/AllUsers\' || grantee.identifier==\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\')])');
          if (out != null && typeof out != 'number') {
              throw new Error("UNDETERMINED condition:503", {cause: {status: 'UNDETERMINED', conditionIndex: 503, conditionText: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'READ\\' || permission==\\'READ_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])').isResultTypeMismatch()", currentStateMessage: "The JSON query did not return a number type.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          } catch (e) {
              throw new Error("UNDETERMINED condition:504", {cause: {status: 'UNDETERMINED', conditionIndex: 504, conditionText: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'READ\\' || permission==\\'READ_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])').isEvaluationFailed()", currentStateMessage: "The JSON query has failed.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: e.message}});
          }
          return out;
      }
      function jsonChecked34() {
          var input = extract36.call(extract36);
          input = TextLib.isEmpty(input) ? null : input;
          var out;
          try {
              out = JSON.parse(input);
          } catch (e) {
              throw new Error("UNDETERMINED condition:502", {cause: {status: 'UNDETERMINED', conditionIndex: 502, conditionText: "extract('CA10__accessControlPolicy__c').asJson().isInvalid()", currentStateMessage: "The Access Control Policy JSON is invalid.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: e.message}});
          }
          return out;
      }
      function fieldChecked37() {
          if (BytesLib.isEmpty(obj.CA10__accessControlPolicy__c)) {
              throw new Error("UNDETERMINED condition:501", {cause: {status: 'UNDETERMINED', conditionIndex: 501, conditionText: "CA10__accessControlPolicy__c.delegatedTo(CA10__accessControlPolicy__c).isEmpty()", currentStateMessage: "Unable to determine the bucket ACL. Possible permission issue with s3:GetBucketAcl", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          return obj.CA10__accessControlPolicy__c;
      }
      function extract36() { if (!this.out) { this.out = fieldChecked37(); } return this.out; };
      function extract33() { if (!this.out) { this.out = jsonChecked34(); } return this.out; };
      try {
          if (comparison30()) {
              return {status: 'INCOMPLIANT', conditionIndex: 599, conditionText: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'READ\\' || permission==\\'READ_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])') > number(0.0)", currentStateMessage: "The bucket ACL grants public read access.", currentStateReferences: references1.join('\n'), remediation: "Modify the bucket ACL to remove grants for 'Everyone' or 'Any authenticated AWS user'. It is strongly recommended to enable 'Block all public access' and use IAM policies for access control.", runtimeError: null};
          }
      } catch (err) {
          if (err.cause && err.cause.status) { return err.cause; } else { throw err; }
      }
      // condition[6], conditionIndex:[600..699]
      function comparison39() {
          var comparisonLeft47 = jsonQueryChecked40();
          return comparisonLeft47 != null && 0.0 != null && comparisonLeft47 > 0.0;
      }
      function jsonQueryChecked40() {
          var input = extract42.call(extract42);
          var out;
          try {
              out = jmespath.search(input, 'length(grants[?(permission==\'WRITE\' || permission==\'WRITE_ACP\') && (grantee.identifier==\'http://acs.amazonaws.com/groups/global/AllUsers\' || grantee.identifier==\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\')])');
          if (out != null && typeof out != 'number') {
              throw new Error("UNDETERMINED condition:603", {cause: {status: 'UNDETERMINED', conditionIndex: 603, conditionText: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'WRITE\\' || permission==\\'WRITE_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])').isResultTypeMismatch()", currentStateMessage: "The JSON query did not return a number type.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          } catch (e) {
              throw new Error("UNDETERMINED condition:604", {cause: {status: 'UNDETERMINED', conditionIndex: 604, conditionText: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'WRITE\\' || permission==\\'WRITE_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])').isEvaluationFailed()", currentStateMessage: "The JSON query has failed.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: e.message}});
          }
          return out;
      }
      function jsonChecked43() {
          var input = extract45.call(extract45);
          input = TextLib.isEmpty(input) ? null : input;
          var out;
          try {
              out = JSON.parse(input);
          } catch (e) {
              throw new Error("UNDETERMINED condition:602", {cause: {status: 'UNDETERMINED', conditionIndex: 602, conditionText: "extract('CA10__accessControlPolicy__c').asJson().isInvalid()", currentStateMessage: "The Access Control Policy JSON is invalid.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: e.message}});
          }
          return out;
      }
      function fieldChecked46() {
          if (BytesLib.isEmpty(obj.CA10__accessControlPolicy__c)) {
              throw new Error("UNDETERMINED condition:601", {cause: {status: 'UNDETERMINED', conditionIndex: 601, conditionText: "CA10__accessControlPolicy__c.delegatedTo(CA10__accessControlPolicy__c).isEmpty()", currentStateMessage: "Unable to determine the bucket ACL. Possible permission issue with s3:GetBucketAcl", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          return obj.CA10__accessControlPolicy__c;
      }
      function extract45() { if (!this.out) { this.out = fieldChecked46(); } return this.out; };
      function extract42() { if (!this.out) { this.out = jsonChecked43(); } return this.out; };
      try {
          if (comparison39()) {
              return {status: 'INCOMPLIANT', conditionIndex: 699, conditionText: "extract('caJsonFrom__accessControlPolicy__c').jsonQueryText('length(grants[?(permission==\\'WRITE\\' || permission==\\'WRITE_ACP\\') && (grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AllUsers\\' || grantee.identifier==\\'http://acs.amazonaws.com/groups/global/AuthenticatedUsers\\')])') > number(0.0)", currentStateMessage: "The bucket ACL grants public write access.", currentStateReferences: references1.join('\n'), remediation: "Modify the bucket ACL to remove grants for 'Everyone' or 'Any authenticated AWS user'. It is strongly recommended to enable 'Block all public access' and use IAM policies for access control.", runtimeError: null};
          }
      } catch (err) {
          if (err.cause && err.cause.status) { return err.cause; } else { throw err; }
      }
      return {status: 'COMPLIANT', conditionIndex: 700, conditionText: "otherwise", currentStateMessage: "The Bucket ACL does not grant public read or write access.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;


  SELECT
    expectedResult.Id as Id,
    IF (
      IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '')
      AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1)
      AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '')
      AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''),
      "MATCH",
      "FAIL"
    ) as match,
    expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus,
    expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex,
    expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText,
    expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError
  FROM UNNEST(mock_ExpectedResult()) expectedResult
  LEFT JOIN (
      SELECT
          sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
          sObject.CA10__blockPublicAcls__c AS CA10__blockPublicAcls__c,
          sObject.CA10__accessControlGrants__c AS CA10__accessControlGrants__c,
          sObject.CA10__accessControlPolicy__c AS CA10__accessControlPolicy__c,
          sObject.Id AS Id,
          process_CA10__CaAwsBucket__c(
              STRUCT(
                  sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                  sObject.CA10__blockPublicAcls__c AS CA10__blockPublicAcls__c,
                  sObject.CA10__accessControlGrants__c AS CA10__accessControlGrants__c,
                  sObject.CA10__accessControlPolicy__c AS CA10__accessControlPolicy__c,
                  sObject.Id AS Id
              ),
              sObject.context.snapshotTime
          ) as result
      FROM UNNEST(mock_CA10__CaAwsBucket__c()) AS sObject
  ) sObject ON sObject.Id = expectedResult.Id;
