---
policy: /ce/ca/aws/rds/instance-publicly-accessible
logic: /ce/ca/aws/rds/instance-publicly-accessible/prod.logic.yaml
executionTime: 2026-02-05T22:32:01.692692851Z
generationMs: 334
executionMs: 2103
rows:
  - id: test1
    match: true
    status:
      expected: DISAPPEARED
      actual: DISAPPEARED
    conditionIndex:
      expected: 99
      actual: 99
    conditionText:
      expected: isDisappeared(CA10__disappearanceTime__c)
      actual: isDisappeared(CA10__disappearanceTime__c)
    runtimeError: {}
  - id: test2
    match: true
    status:
      expected: COMPLIANT
      actual: COMPLIANT
    conditionIndex:
      expected: 199
      actual: 199
    conditionText:
      expected: not(extract('CA10__publiclyAccessible__c'))
      actual: not(extract('CA10__publiclyAccessible__c'))
    runtimeError: {}
  - id: test3
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 299
      actual: 299
    conditionText:
      expected: CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.has(INCOMPLIANT)
      actual: CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.has(INCOMPLIANT)
    runtimeError: {}
  - id: test4
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 399
      actual: 399
    conditionText:
      expected: CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.has(COMPLIANT)
      actual: CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.has(COMPLIANT)
    runtimeError: {}
  - id: test5
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 499
      actual: 499
    conditionText:
      expected: CA10__vpc__r.CA10__routeTables__r.has(INCOMPLIANT)
      actual: CA10__vpc__r.CA10__routeTables__r.has(INCOMPLIANT)
    runtimeError: {}
  - id: test6
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 500
      actual: 500
    conditionText:
      expected: otherwise
      actual: otherwise
    runtimeError: {}
usedFiles:
  - path: /ce/ca/aws/rds/instance-publicly-accessible/policy.yaml
    md5Hash: F2100A2C67DBF3C331422243101B6C2A
    content: |
      ---
      names:
        full: AWS RDS Instance is publicly accessible
        contextual: Instance is publicly accessible
      description: "Ensure and verify that RDS database instances provisioned in your AWS\
        \ account do restrict unauthorized access in order to minimize security risks. To\
        \ restrict access to any publicly accessible RDS database instance, you must disable\
        \ the database Publicly Accessible flag and update the VPC security group associated\
        \ with the instance."
      type: COMPLIANCE_POLICY
      categories:
        - SECURITY
      frameworkMappings:
        - "/frameworks/cis-aws-v6.0.0/03/02/03"
        - "/frameworks/cloudaware/resource-security/public-and-anonymous-access"
        - "/frameworks/aws-fsbp-v1.0.0/rds/02"
      similarPolicies:
        awsSecurityHub:
          - name: "[RDS.2] RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible configuration"
            url: "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-2"
          - name: "[RDS.46] RDS DB instances should not be deployed in public subnets with routes to internet gateways"
            url: "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-46"
        cloudConformity:
          - url: https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/RDS/rds-publicly-accessible.html
            name: RDS Publicly Accessible
          - url: https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/instance-not-in-public-subnet.html
            name: RDS Instance Not In Public Subnet
        internal:
          - dec-x-f937c35f
  - path: /ce/ca/aws/rds/instance-publicly-accessible/prod.logic.yaml
    md5Hash: E36A18BF5F04BE64A607C9F8A3F47989
    content: |
      ---
      # This policy goes through the same paths as /ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/prod.logic.yaml
      # Check that policy logic for details
      inputType: "CA10__CaAwsDbInstance__c"
      testData:
       - file: test-data.json
      importExtracts:
        - file: /types/CA10__CaAwsDbInstance__c/object.extracts.yaml
      conditions:
        - status: "COMPLIANT"
          currentStateMessage: "This RDS Instance is not Publicly Accessible."
          check:
            NOT:
              arg:
                EXTRACT: "CA10__publiclyAccessible__c"
        - status: "INCOMPLIANT"
          currentStateMessage: "This RDS Instance is publicly accessible and in a public subnet."
          remediationMessage: "Consider restricting public access to the instance."
          check:
            RELATED_LIST_HAS:
              status: "INCOMPLIANT"
              relationshipName: "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r"
        - status: "INCOMPLIANT"
          currentStateMessage: "This RDS Instance is publicly accessible but in a private subnet."
          remediationMessage: "Consider restricting public access to the instance."
          check:
            RELATED_LIST_HAS:
              status: "COMPLIANT"
              relationshipName: "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r"
        - status: "INCOMPLIANT"
          currentStateMessage: "This RDS Instance is publicly accessible and in a public subnet."
          remediationMessage: "Consider restricting public access to the instance."
          check:
            RELATED_LIST_HAS:
              status: "INCOMPLIANT"
              relationshipName: "CA10__vpc__r.CA10__routeTables__r"
      otherwise:
        status: "INCOMPLIANT"
        currentStateMessage: "This RDS Instance is publicly accessible but in a private subnet."
        remediationMessage: "Consider restricting public access to the instance."
      relatedLists:
        - relationshipName: "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r"
          conditions:
            - status: "INCOMPLIANT"
              currentStateMessage: "This Subnet Group has subnet route table with an Internet Gateway route with unrestricted access."
              remediationMessage: "Consider removing Internet Gateway routes with unrestricted access."
              check:
                RELATED_LIST_HAS:
                  status: "INCOMPLIANT"
                  relationshipName: "CA10__subnet__r.CA10__routeTableAssociations__r"
            - status: "COMPLIANT"
              currentStateMessage: "This Subnet Group has subnet route table with an Internet Gateway route with unrestricted access."
              check:
                RELATED_LIST_HAS:
                  status: "COMPLIANT"
                  relationshipName: "CA10__subnet__r.CA10__routeTableAssociations__r"
          otherwise:
            status: "INAPPLICABLE"
            currentStateMessage: "This subnet group doesn't have route table associations."
          relatedLists:
            - relationshipName: "CA10__subnet__r.CA10__routeTableAssociations__r"
              importExtracts:
              - file: "/types/CA10__CaAwsRoute__c/object.extracts.yaml"
              conditions:
                - status: "INCOMPLIANT"
                  currentStateMessage: "This subnet route table has an Internet Gateway route with unrestricted access."
                  remediationMessage: "Consider removing Internet Gateway routes with unrestricted access."
                  check:
                    RELATED_LIST_HAS:
                      status: "INCOMPLIANT"
                      relationshipName: "CA10__routeTable__r.CA10__routes__r"
              otherwise:
                status: "COMPLIANT"
                currentStateMessage: "This subnet is compliant"
              relatedLists:
                - relationshipName: "CA10__routeTable__r.CA10__routes__r"
                  conditions:
                    - status: "INCOMPLIANT"
                      currentStateMessage: "This is an Internet Gateway route with unrestricted access."
                      remediationMessage: "Consider removing this route."
                      check:
                        AND:
                          args:
                            - STARTS_WITH:
                                arg:
                                  EXTRACT: "CA10__gatewayId__c"
                                search:
                                  TEXT: "igw"
                            - OR:
                                args:
                                  - IS_EQUAL:
                                      left:
                                        EXTRACT: "CA10__destinationCidrBlock__c"
                                      right:
                                        TEXT: "0.0.0.0/0"
                                  - IS_EQUAL:
                                      left:
                                        EXTRACT: "CA10__destinationIpv6CidrBlock__c"
                                      right:
                                        TEXT: "::/0"
                  otherwise:
                    status: "COMPLIANT"
                    currentStateMessage: "This is not an Internet Gateway Route."
        - relationshipName: "CA10__vpc__r.CA10__routeTables__r"
          importExtracts:
            - file: "/types/CA10__CaAwsRoute__c/object.extracts.yaml"
            - file: "/types/CA10__CaAwsRouteTableAssociation__c/object.extracts.yaml"
          conditions:
            - status: "INCOMPLIANT"
              currentStateMessage: "This is a Main Route Table with an Internet Gateway route."
              remediationMessage: "Consider removing this route."
              check:
                AND:
                  args:
                    - RELATED_LIST_HAS:
                        status: "COMPLIANT"
                        relationshipName: "CA10__routeTableAssociations__r"
                    - RELATED_LIST_HAS:
                        status: "INCOMPLIANT"
                        relationshipName: "CA10__routes__r"
          otherwise:
            status: "INAPPLICABLE"
            currentStateMessage: "Custom Route Tables or Main Route Table without Internet Gateway."
          relatedLists:
            - relationshipName: "CA10__routeTableAssociations__r"
              conditions:
                - status: "COMPLIANT"
                  currentStateMessage: "This is a Main Route Table."
                  check:
                    IS_EQUAL:
                      left:
                        EXTRACT: "CA10__main__c"
                      right:
                        BOOLEAN: true
              otherwise:
                status: "INAPPLICABLE"
                currentStateMessage: "This is not a Main Route Table."
            - relationshipName: "CA10__routes__r"
              conditions:
                - status: "INCOMPLIANT"
                  currentStateMessage: "This is an Internet Gateway route."
                  remediationMessage: "Consider removing this route."
                  check:
                    AND:
                      args:
                        - STARTS_WITH:
                            arg:
                              EXTRACT: "CA10__gatewayId__c"
                            search:
                              TEXT: "igw"
                        - OR:
                            args:
                              - IS_EQUAL:
                                  left:
                                    EXTRACT: "CA10__destinationCidrBlock__c"
                                  right:
                                    TEXT: "0.0.0.0/0"
                              - IS_EQUAL:
                                  left:
                                    EXTRACT: "CA10__destinationIpv6CidrBlock__c"
                                  right:
                                    TEXT: "::/0"
              otherwise:
                status: "COMPLIANT"
                currentStateMessage: "This is not an Internet Gateway Route."
  - path: /ce/ca/aws/rds/instance-publicly-accessible/test-data.json
    md5Hash: A619230932B0669DBE429239C538EA58
    content: |-
      [
          {
              "expectedResult": {
                  "status": "DISAPPEARED",
                  "conditionIndex": "99",
                  "conditionText": "isDisappeared(CA10__disappearanceTime__c)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-07-11T20:42:28Z"
              },
              "Id": "test1",
              "CA10__disappearanceTime__c": "2024-07-11T20:42:28Z",
              "CA10__publiclyAccessible__c": false,
              "CA10__subnetGroup__c": "subnetGroup1",
              "CA10__vpc__c": "vpc1",
              "CA10__subnetGroup__r": {
                  "Id": "subnetGroup1",
                  "CA10__AWS_RDS_Subnet_Group_Subnet_Links__r": []
              },
              "CA10__vpc__r": {
                  "Id": "vpc1",
                  "CA10__routeTables__r": []
              }
          },
          {
              "expectedResult": {
                  "status": "COMPLIANT",
                  "conditionIndex": "199",
                  "conditionText": "not(extract('CA10__publiclyAccessible__c'))",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-07-11T20:42:28Z"
              },
              "Id": "test2",
              "CA10__disappearanceTime__c": null,
              "CA10__publiclyAccessible__c": false,
              "CA10__subnetGroup__c": "subnetGroup2",
              "CA10__vpc__c": "vpc2",
              "CA10__subnetGroup__r": {
                  "Id": "subnetGroup2",
                  "CA10__AWS_RDS_Subnet_Group_Subnet_Links__r": []
              },
              "CA10__vpc__r": {
                  "Id": "vpc2",
                  "CA10__routeTables__r": []
              }
          },
          {
              "expectedResult": {
                  "status": "INCOMPLIANT",
                  "conditionIndex": "299",
                  "conditionText": "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.has(INCOMPLIANT)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-07-11T20:42:28Z"
              },
              "Id": "test3",
              "CA10__disappearanceTime__c": null,
              "CA10__publiclyAccessible__c": true,
              "CA10__subnetGroup__c": "subnetGroup3",
              "CA10__vpc__c": "vpc3",
              "CA10__subnetGroup__r": {
                  "Id": "subnetGroup3",
                  "CA10__AWS_RDS_Subnet_Group_Subnet_Links__r": [
                      {
                          "Id": "test3_1",
                          "CA10__disappearanceTime__c": null,
                          "CA10__subnetGroup__c": "subnetGroup3",
                          "CA10__subnet__c": "subnet3",
                          "CA10__subnet__r": {
                              "Id": "subnet3",
                              "CA10__routeTableAssociations__r": [
                                  {
                                      "Id": "test3_2",
                                      "CA10__disappearanceTime__c": null,
                                      "CA10__subnet__c": "subnet3",
                                      "CA10__routeTable__c": "routeTable3",
                                      "CA10__routeTable__r": {
                                          "Id": "routeTable3",
                                          "CA10__routes__r": [
                                              {
                                                  "Id": "test3_3",
                                                  "CA10__disappearanceTime__c": null,
                                                  "CA10__gatewayId__c": "igw-123456789",
                                                  "CA10__routeTable__c": "routeTable3",
                                                  "CA10__destinationCidrBlock__c": "0.0.0.0/0",
                                                  "CA10__destinationIpv6CidrBlock__c": null
                                              }
                                          ]
                                      }
                                  }
                              ]
                          }
                      }
                  ]
              },
              "CA10__vpc__r": {
                  "Id": "vpc3",
                  "CA10__routeTables__r": []
              }
          },
          {
              "expectedResult": {
                  "status": "INCOMPLIANT",
                  "conditionIndex": "399",
                  "conditionText": "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.has(COMPLIANT)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-07-11T20:42:28Z"
              },
              "Id": "test4",
              "CA10__disappearanceTime__c": null,
              "CA10__publiclyAccessible__c": true,
              "CA10__subnetGroup__c": "subnetGroup4",
              "CA10__vpc__c": "vpc4",
              "CA10__subnetGroup__r": {
                  "Id": "subnetGroup4",
                  "CA10__AWS_RDS_Subnet_Group_Subnet_Links__r": [
                      {
                          "Id": "test4_1",
                          "CA10__disappearanceTime__c": null,
                          "CA10__subnetGroup__c": "subnetGroup4",
                          "CA10__subnet__c": "subnet4",
                          "CA10__subnet__r": {
                              "Id": "subnet4",
                              "CA10__routeTableAssociations__r": [
                                  {
                                      "Id": "test4_2",
                                      "CA10__disappearanceTime__c": null,
                                      "CA10__main__c" : false,
                                      "CA10__subnet__c": "subnet4",
                                      "CA10__routeTable__c": "routeTable4",
                                      "CA10__routeTable__r": {
                                          "Id": "routeTable4",
                                          "CA10__routes__r": [
                                              {
                                                  "Id": "test4_3",
                                                  "CA10__disappearanceTime__c": null,
                                                  "CA10__gatewayId__c": "local",
                                                  "CA10__routeTable__c": "routeTable4",
                                                  "CA10__destinationCidrBlock__c": "1.1.1.1/32",
                                                  "CA10__destinationIpv6CidrBlock__c": null
                                              }
                                          ]
                                      }
                                  }
                              ]
                          }
                      }
                  ]
              },
              "CA10__vpc__r": {
                  "Id": "vpc4",
                  "CA10__routeTables__r": []
              }
          },
          {
              "expectedResult": {
                  "status": "INCOMPLIANT",
                  "conditionIndex": "499",
                  "conditionText": "CA10__vpc__r.CA10__routeTables__r.has(INCOMPLIANT)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-07-11T20:42:28Z"
              },
              "Id": "test5",
              "CA10__disappearanceTime__c": null,
              "CA10__publiclyAccessible__c": true,
              "CA10__subnetGroup__c": "subnetGroup5",
              "CA10__vpc__c": "vpc5",
              "CA10__subnetGroup__r": {
                  "Id": "subnetGroup5",
                  "CA10__AWS_RDS_Subnet_Group_Subnet_Links__r": []
              },
              "CA10__vpc__r": {
                  "Id": "vpc5",
                  "CA10__routeTables__r": [
                      {
                          "Id": "routeTable5",
                          "CA10__disappearanceTime__c": null,
                          "CA10__vpc__c": "vpc5",
                          "CA10__routeTableAssociations__r": [
                              {
                                  "Id": "test5_1",
                                  "CA10__disappearanceTime__c": null,
                                  "CA10__main__c": true,
                                  "CA10__routeTable__c": "routeTable5"
                              }
                          ],
                          "CA10__routes__r": [
                              {
                                  "Id": "test5_2",
                                  "CA10__disappearanceTime__c": null,
                                  "CA10__gatewayId__c": "igw-5",
                                  "CA10__routeTable__c": "routeTable5",
                                  "CA10__destinationCidrBlock__c": "0.0.0.0/0",
                                  "CA10__destinationIpv6CidrBlock__c": null

                              }
                          ]
                      }
                  ]
              }
          },
          {
              "expectedResult": {
                  "status": "INCOMPLIANT",
                  "conditionIndex": "500",
                  "conditionText": "otherwise",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-07-11T20:42:28Z"
              },
              "Id": "test6",
              "CA10__disappearanceTime__c": null,
              "CA10__publiclyAccessible__c": true,
              "CA10__subnetGroup__c": "subnetGroup6",
              "CA10__vpc__c": "vpc6",
              "CA10__subnetGroup__r": {
                  "Id": "subnetGroup6",
                  "CA10__AWS_RDS_Subnet_Group_Subnet_Links__r": []
              },
              "CA10__vpc__r": {
                  "Id": "vpc6",
                  "CA10__routeTables__r": [
                      {
                          "Id": "routeTable6",
                          "CA10__disappearanceTime__c": null,
                          "CA10__vpc__c": "vpc6",
                          "CA10__routeTableAssociations__r": [
                              {
                                  "Id": "test6_1",
                                  "CA10__disappearanceTime__c": null,
                                  "CA10__main__c": true,
                                  "CA10__routeTable__c": "routeTable6"
                              }
                          ],
                          "CA10__routes__r": [
                              {
                                  "Id": "test6_2",
                                  "CA10__disappearanceTime__c": null,
                                  "CA10__gatewayId__c": "igw-6",
                                  "CA10__routeTable__c": "routeTable6",
                                  "CA10__destinationCidrBlock__c": "1.1.1.1/32",
                                  "CA10__destinationIpv6CidrBlock__c": null

                              }
                          ]
                      }
                  ]
              }
          }
      ]
  - path: /types/CA10__CaAwsRouteTableAssociation__c/object.extracts.yaml
    md5Hash: A7C7920B6078DD78806ADA0DC37D345B
    content: "---\nextracts:\n# Checkbox. Can't have no access, retrieved via ec2:DescribeRouteTables\n\
      \  - name: \"CA10__main__c\"\n    value: \n      FIELD:\n        path: \"CA10__main__c\""
  - path: /types/CA10__CaAwsRoute__c/object.extracts.yaml
    md5Hash: E4999A9B58375B79BA8254DDA1FC6534
    content: "---\nextracts:\n# Nullable. Can't have no access, retrieved via ec2:DescribeRouteTables\n\
      \  - name: \"CA10__gatewayId__c\"\n    value: \n      FIELD:\n        path:\
      \ \"CA10__gatewayId__c\"\n# Nullable. Can't have no access, retrieved via ec2:DescribeRouteTables\n\
      \  - name: \"CA10__destinationIpv6CidrBlock__c\"\n    value: \n      FIELD:\n\
      \        path: \"CA10__destinationIpv6CidrBlock__c\"\n# Nullable. Can't have\
      \ no access, retrieved via ec2:DescribeRouteTables\n  - name: \"CA10__destinationCidrBlock__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10__destinationCidrBlock__c\""
  - path: /types/CA10__CaAwsDbInstance__c/object.extracts.yaml
    md5Hash: E3FA5A211AA9AD2418645BB09047D3D3
    content: "---\nextracts:\n# Not Nullable. Can't have no access, retrieved via\
      \ rds:DescribeDBInstances\n  - name: CA10__engine__c\n    value:\n      FIELD:\n\
      \        path: CA10__engine__c\n        undeterminedIf:\n          isEmpty:\
      \ \"Corrupted data. DB Instance Engine cannot be empty.\"\n# Not Nullable. Can't\
      \ have no access, retrieved via rds:DescribeDBInstances\n  - name: CA10__endpointPort__c\n\
      \    value:\n      FIELD:\n        path: CA10__endpointPort__c\n        undeterminedIf:\n\
      \          isEmpty: \"Corrupted data. DB Endpoint Port cannot be empty.\"\n\
      # Checkbox. Can't have no access, retrieved via rds:DescribeDBInstances\n  -\
      \ name: CA10__publiclyAccessible__c\n    value:\n      FIELD:\n        path:\
      \ CA10__publiclyAccessible__c\n# Checkbox. Can't have no access, retrieved via\
      \ rds:DescribeDBInstances\n  - name: CA10__storageEncrypted__c\n    value: \n\
      \      FIELD:\n        path: CA10__storageEncrypted__c\n# Checkbox. Can't have\
      \ no access, retrieved via rds:DescribeDBInstances\n  - name: CA10__autoMinorVersionUpgrade__c\n\
      \    value: \n      FIELD:\n        path: CA10__autoMinorVersionUpgrade__c\n\
      # Checkbox. Can't have no access, retrieved via rds:DescribeDBInstances\n  -\
      \ name: CA10__multiAz__c\n    value: \n      FIELD:\n        path: CA10__multiAz__c\n\
      # Nullable. Values: available, backing-up, creating ...\n  - name: \"CA10__status__c\"\
      \n    value:\n      FIELD:\n        path: \"CA10__status__c\"\n# Nullable.\n\
      \  - name: \"CA10__createTime__c\"\n    value:\n      FIELD:\n        path:\
      \ \"CA10__createTime__c\"\n# Nullable.\n  - name: \"CA10__averageCpuOneMonth__c\"\
      \n    value:\n      FIELD:\n        path: \"CA10__averageCpuOneMonth__c\"\n\
      # Nullable.\n  - name: \"CA10__regionName__c\"\n    value:\n      FIELD:\n \
      \       path: \"CA10__regionName__c\"\n# Nullable.\n  - name: \"CA10__diskReadIopsAvg30d__c\"\
      \n    value:\n      FIELD:\n        path: \"CA10__diskReadIopsAvg30d__c\"\n\
      # Nullable.\n  - name: \"CA10__diskWriteIopsAvg30d__c\"\n    value:\n      FIELD:\n\
      \        path: \"CA10__diskWriteIopsAvg30d__c\"\n# Nullable.\n  - name: \"CA10__databaseConnectionsAvg30d__c\"\
      \n    value:\n      FIELD:\n        path: \"CA10__databaseConnectionsAvg30d__c\"\
      \n# Not nullable. Can't have no access, retrieved via rds:DescribeDBInstances\n\
      \  - name: \"CA10__backupRetentionPeriod__c\"\n    value:\n      FIELD:\n  \
      \      path: \"CA10__backupRetentionPeriod__c\"\n# Text.\n  - name: CA10__masterUsername__c\n\
      \    value:\n      FIELD:\n        path: CA10__masterUsername__c\n# Checkbox.\n\
      \  - name: CA10__iamDatabaseAuthenticationEnabled__c\n    value:\n      FIELD:\n\
      \        path: CA10__iamDatabaseAuthenticationEnabled__c\n# Text.\n  - name:\
      \ CA10__enabledCloudWatchLogsExports__c\n    value:\n      FIELD:\n        path:\
      \ CA10__enabledCloudWatchLogsExports__c\n# Checkbox.\n  - name: CA10__deletionProtection__c\n\
      \    value:\n      FIELD:\n        path: CA10__deletionProtection__c\n# Nullable.\
      \ Can't have no access, retrieved via rds:DescribeDBInstances\n  - name: CA10__clusterArn__c\n\
      \    value:\n      FIELD:\n        path: CA10__clusterArn__c\n# Not nullable.\
      \ Can't have no access, retrieved via rds:DescribeDBInstances\n  - name: \"\
      CA10__monitoringInterval__c\"\n    value:\n      FIELD:\n        path: \"CA10__monitoringInterval__c\"\
      \n# Checkbox.\n  - name: CA10__copyTagsToSnapshot__c\n    value:\n      FIELD:\n\
      \        path: CA10__copyTagsToSnapshot__c\n"
script: |-
  CREATE TEMP FUNCTION mock_ExpectedResult()
  RETURNS ARRAY<STRUCT<
          Id STRING,
          expectedResult STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, runtimeError STRING>
      >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "Id" : "test1",
    "expectedResult" : {
      "status" : "DISAPPEARED",
      "conditionIndex" : "99",
      "conditionText" : "isDisappeared(CA10__disappearanceTime__c)",
      "runtimeError" : null
    }
  }, {
    "Id" : "test2",
    "expectedResult" : {
      "status" : "COMPLIANT",
      "conditionIndex" : "199",
      "conditionText" : "not(extract('CA10__publiclyAccessible__c'))",
      "runtimeError" : null
    }
  }, {
    "Id" : "test3",
    "expectedResult" : {
      "status" : "INCOMPLIANT",
      "conditionIndex" : "299",
      "conditionText" : "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.has(INCOMPLIANT)",
      "runtimeError" : null
    }
  }, {
    "Id" : "test4",
    "expectedResult" : {
      "status" : "INCOMPLIANT",
      "conditionIndex" : "399",
      "conditionText" : "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.has(COMPLIANT)",
      "runtimeError" : null
    }
  }, {
    "Id" : "test5",
    "expectedResult" : {
      "status" : "INCOMPLIANT",
      "conditionIndex" : "499",
      "conditionText" : "CA10__vpc__r.CA10__routeTables__r.has(INCOMPLIANT)",
      "runtimeError" : null
    }
  }, {
    "Id" : "test6",
    "expectedResult" : {
      "status" : "INCOMPLIANT",
      "conditionIndex" : "500",
      "conditionText" : "otherwise",
      "runtimeError" : null
    }
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaAwsDbInstance__c()
  RETURNS ARRAY<STRUCT<
      CA10__disappearanceTime__c TIMESTAMP,
      CA10__publiclyAccessible__c BOOLEAN,
      Id STRING,
      CA10__subnetGroup__c STRING,
      CA10__vpc__c STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__disappearanceTime__c" : new Date("2024-07-11T20:42:28Z"),
    "CA10__publiclyAccessible__c" : false,
    "Id" : "test1",
    "CA10__subnetGroup__c" : "subnetGroup1",
    "CA10__vpc__c" : "vpc1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__publiclyAccessible__c" : false,
    "Id" : "test2",
    "CA10__subnetGroup__c" : "subnetGroup2",
    "CA10__vpc__c" : "vpc2"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__publiclyAccessible__c" : true,
    "Id" : "test3",
    "CA10__subnetGroup__c" : "subnetGroup3",
    "CA10__vpc__c" : "vpc3"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__publiclyAccessible__c" : true,
    "Id" : "test4",
    "CA10__subnetGroup__c" : "subnetGroup4",
    "CA10__vpc__c" : "vpc4"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__publiclyAccessible__c" : true,
    "Id" : "test5",
    "CA10__subnetGroup__c" : "subnetGroup5",
    "CA10__vpc__c" : "vpc5"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__publiclyAccessible__c" : true,
    "Id" : "test6",
    "CA10__subnetGroup__c" : "subnetGroup6",
    "CA10__vpc__c" : "vpc6"
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaAwsDbSubnetGroup__c()
  RETURNS ARRAY<STRUCT<
      Id STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "subnetGroup1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "subnetGroup2"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "subnetGroup3"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "subnetGroup4"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "subnetGroup5"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "subnetGroup6"
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaAwsDbSubnetGroupSubnetLink__c()
  RETURNS ARRAY<STRUCT<
      CA10__disappearanceTime__c TIMESTAMP,
      CA10__subnetGroup__c STRING,
      Id STRING,
      CA10__subnet__c STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__subnetGroup__c" : "subnetGroup3",
    "Id" : "test3_1",
    "CA10__subnet__c" : "subnet3"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__subnetGroup__c" : "subnetGroup4",
    "Id" : "test4_1",
    "CA10__subnet__c" : "subnet4"
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaAwsSubnet__c()
  RETURNS ARRAY<STRUCT<
      Id STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "subnet3"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "subnet4"
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaAwsRouteTableAssociation__c()
  RETURNS ARRAY<STRUCT<
      CA10__disappearanceTime__c TIMESTAMP,
      CA10__subnet__c STRING,
      Id STRING,
      CA10__routeTable__c STRING,
      CA10__main__c BOOLEAN,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__subnet__c" : "subnet3",
    "Id" : "test3_2",
    "CA10__routeTable__c" : "routeTable3"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__subnet__c" : "subnet4",
    "Id" : "test4_2",
    "CA10__routeTable__c" : "routeTable4"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__main__c" : true,
    "CA10__routeTable__c" : "routeTable5",
    "Id" : "test5_1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__main__c" : true,
    "CA10__routeTable__c" : "routeTable6",
    "Id" : "test6_1"
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaAwsRouteTable__c()
  RETURNS ARRAY<STRUCT<
      Id STRING,
      CA10__disappearanceTime__c TIMESTAMP,
      CA10__vpc__c STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "routeTable3"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "routeTable4"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__vpc__c" : "vpc5",
    "Id" : "routeTable5"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__vpc__c" : "vpc6",
    "Id" : "routeTable6"
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaAwsRoute__c()
  RETURNS ARRAY<STRUCT<
      CA10__disappearanceTime__c TIMESTAMP,
      CA10__gatewayId__c STRING,
      CA10__destinationCidrBlock__c STRING,
      CA10__destinationIpv6CidrBlock__c STRING,
      CA10__routeTable__c STRING,
      Id STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__gatewayId__c" : "igw-123456789",
    "CA10__destinationCidrBlock__c" : "0.0.0.0/0",
    "CA10__destinationIpv6CidrBlock__c" : null,
    "CA10__routeTable__c" : "routeTable3",
    "Id" : "test3_3"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__gatewayId__c" : "local",
    "CA10__destinationCidrBlock__c" : "1.1.1.1/32",
    "CA10__destinationIpv6CidrBlock__c" : null,
    "CA10__routeTable__c" : "routeTable4",
    "Id" : "test4_3"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__gatewayId__c" : "igw-5",
    "CA10__destinationCidrBlock__c" : "0.0.0.0/0",
    "CA10__destinationIpv6CidrBlock__c" : null,
    "CA10__routeTable__c" : "routeTable5",
    "Id" : "test5_2"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "CA10__gatewayId__c" : "igw-6",
    "CA10__destinationCidrBlock__c" : "1.1.1.1/32",
    "CA10__destinationIpv6CidrBlock__c" : null,
    "CA10__routeTable__c" : "routeTable6",
    "Id" : "test6_2"
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaAwsVpc__c()
  RETURNS ARRAY<STRUCT<
      Id STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "vpc1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "vpc2"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "vpc3"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "vpc4"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "vpc5"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-07-11T20:42:28Z")
    },
    "Id" : "vpc6"
  } ];
  """;

  CREATE TEMP FUNCTION process_CA10__CaAwsDbInstance__c(
      obj STRUCT<
          CA10__disappearanceTime__c TIMESTAMP,
          CA10__publiclyAccessible__c BOOLEAN,
          Id STRING,
          CA10__subnetGroup__c STRING,
          CA10__vpc__c STRING,
          CA10__subnetGroup__r STRUCT<
              Id STRING,
              CA10__AWS_RDS_Subnet_Group_Subnet_Links__r ARRAY<STRUCT<
                  CA10__disappearanceTime__c TIMESTAMP,
                  CA10__subnetGroup__c STRING,
                  Id STRING,
                  CA10__subnet__c STRING,
                  CA10__subnet__r STRUCT<
                      Id STRING,
                      CA10__routeTableAssociations__r ARRAY<STRUCT<
                          CA10__disappearanceTime__c TIMESTAMP,
                          CA10__subnet__c STRING,
                          Id STRING,
                          CA10__routeTable__c STRING,
                          CA10__routeTable__r STRUCT<
                              Id STRING,
                              CA10__routes__r ARRAY<STRUCT<
                                  CA10__disappearanceTime__c TIMESTAMP,
                                  CA10__gatewayId__c STRING,
                                  CA10__destinationCidrBlock__c STRING,
                                  CA10__destinationIpv6CidrBlock__c STRING,
                                  CA10__routeTable__c STRING,
                                  Id STRING,
                                  result STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
                              >>
                          >,
                          result STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
                      >>
                  >,
                  result STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
              >>
          >,
          CA10__vpc__r STRUCT<
              Id STRING,
              CA10__routeTables__r ARRAY<STRUCT<
                  CA10__disappearanceTime__c TIMESTAMP,
                  CA10__vpc__c STRING,
                  Id STRING,
                  CA10__routeTableAssociations__r ARRAY<STRUCT<
                      CA10__disappearanceTime__c TIMESTAMP,
                      CA10__main__c BOOLEAN,
                      CA10__routeTable__c STRING,
                      Id STRING,
                      result STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
                  >>,
                  CA10__routes__r ARRAY<STRUCT<
                      CA10__disappearanceTime__c TIMESTAMP,
                      CA10__gatewayId__c STRING,
                      CA10__destinationCidrBlock__c STRING,
                      CA10__destinationIpv6CidrBlock__c STRING,
                      CA10__routeTable__c STRING,
                      Id STRING,
                      result STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
                  >>,
                  result STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
              >>
          >
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c);
      if (obj.CA10__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[1], conditionIndex:[100..199]
      function extract3() { if (!this.out) { this.out = obj.CA10__publiclyAccessible__c; } return this.out; };
      references1.push('Publicly Accessible [obj.CA10__publiclyAccessible__c]: ' + obj.CA10__publiclyAccessible__c);
      if (!extract3.call(extract3)) {
          return {status: 'COMPLIANT', conditionIndex: 199, conditionText: "not(extract('CA10__publiclyAccessible__c'))", currentStateMessage: "This RDS Instance is not Publicly Accessible.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      var count_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r_INCOMPLIANT5 = 0;
      if (obj.CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r != null) {
          for (var i6 = 0; i6 < obj.CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.length; i6++) {
              if (typeof(obj.CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r[i6].status) !== 'undefined') {
                  if (obj.CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r[i6].status == 'INCOMPLIANT') {
                      count_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r_INCOMPLIANT5 += obj.CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r[i6].count;
                  }
              } else  {
                  if (obj.CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r[i6].result.status == 'INCOMPLIANT') {
                      count_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r_INCOMPLIANT5 += 1;
                  }
              }
          }
      }
      // condition[2], conditionIndex:[200..299]
      references1.push('Related list [CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r] ' + (count_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r_INCOMPLIANT5 > 0 ? 'has' : 'does not have') + ' objects in INCOMPLIANT status');
      if (count_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r_INCOMPLIANT5 > 0) {
          return {status: 'INCOMPLIANT', conditionIndex: 299, conditionText: "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.has(INCOMPLIANT)", currentStateMessage: "This RDS Instance is publicly accessible and in a public subnet.", currentStateReferences: references1.join('\n'), remediation: "Consider restricting public access to the instance.", runtimeError: null};
      }
      var count_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r_COMPLIANT7 = 0;
      if (obj.CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r != null) {
          for (var i8 = 0; i8 < obj.CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.length; i8++) {
              if (typeof(obj.CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r[i8].status) !== 'undefined') {
                  if (obj.CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r[i8].status == 'COMPLIANT') {
                      count_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r_COMPLIANT7 += obj.CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r[i8].count;
                  }
              } else  {
                  if (obj.CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r[i8].result.status == 'COMPLIANT') {
                      count_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r_COMPLIANT7 += 1;
                  }
              }
          }
      }
      // condition[3], conditionIndex:[300..399]
      if (count_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r_COMPLIANT7 > 0) {
          return {status: 'INCOMPLIANT', conditionIndex: 399, conditionText: "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.has(COMPLIANT)", currentStateMessage: "This RDS Instance is publicly accessible but in a private subnet.", currentStateReferences: references1.join('\n'), remediation: "Consider restricting public access to the instance.", runtimeError: null};
      }
      var count_CA10__vpc__r_CA10__routeTables__r_INCOMPLIANT9 = 0;
      if (obj.CA10__vpc__r.CA10__routeTables__r != null) {
          for (var i10 = 0; i10 < obj.CA10__vpc__r.CA10__routeTables__r.length; i10++) {
              if (typeof(obj.CA10__vpc__r.CA10__routeTables__r[i10].status) !== 'undefined') {
                  if (obj.CA10__vpc__r.CA10__routeTables__r[i10].status == 'INCOMPLIANT') {
                      count_CA10__vpc__r_CA10__routeTables__r_INCOMPLIANT9 += obj.CA10__vpc__r.CA10__routeTables__r[i10].count;
                  }
              } else  {
                  if (obj.CA10__vpc__r.CA10__routeTables__r[i10].result.status == 'INCOMPLIANT') {
                      count_CA10__vpc__r_CA10__routeTables__r_INCOMPLIANT9 += 1;
                  }
              }
          }
      }
      // condition[4], conditionIndex:[400..499]
      references1.push('Related list [CA10__vpc__r.CA10__routeTables__r] ' + (count_CA10__vpc__r_CA10__routeTables__r_INCOMPLIANT9 > 0 ? 'has' : 'does not have') + ' objects in INCOMPLIANT status');
      if (count_CA10__vpc__r_CA10__routeTables__r_INCOMPLIANT9 > 0) {
          return {status: 'INCOMPLIANT', conditionIndex: 499, conditionText: "CA10__vpc__r.CA10__routeTables__r.has(INCOMPLIANT)", currentStateMessage: "This RDS Instance is publicly accessible and in a public subnet.", currentStateReferences: references1.join('\n'), remediation: "Consider restricting public access to the instance.", runtimeError: null};
      }
      return {status: 'INCOMPLIANT', conditionIndex: 500, conditionText: "otherwise", currentStateMessage: "This RDS Instance is publicly accessible but in a private subnet.", currentStateReferences: references1.join('\n'), remediation: "Consider restricting public access to the instance.", runtimeError: null};
  """;

  CREATE TEMP FUNCTION process_CA10__vpc__r_CA10__routeTables__r(
      obj STRUCT<
          CA10__disappearanceTime__c TIMESTAMP,
          CA10__vpc__c STRING,
          Id STRING,
          CA10__routeTableAssociations__r ARRAY<STRUCT<
              CA10__disappearanceTime__c TIMESTAMP,
              CA10__main__c BOOLEAN,
              CA10__routeTable__c STRING,
              Id STRING,
              result STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
          >>,
          CA10__routes__r ARRAY<STRUCT<
              CA10__disappearanceTime__c TIMESTAMP,
              CA10__gatewayId__c STRING,
              CA10__destinationCidrBlock__c STRING,
              CA10__destinationIpv6CidrBlock__c STRING,
              CA10__routeTable__c STRING,
              Id STRING,
              result STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
          >>
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c);
      if (obj.CA10__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      var count_CA10__routes__r_INCOMPLIANT3 = 0;
      if (obj.CA10__routes__r != null) {
          for (var i4 = 0; i4 < obj.CA10__routes__r.length; i4++) {
              if (typeof(obj.CA10__routes__r[i4].status) !== 'undefined') {
                  if (obj.CA10__routes__r[i4].status == 'INCOMPLIANT') {
                      count_CA10__routes__r_INCOMPLIANT3 += obj.CA10__routes__r[i4].count;
                  }
              } else  {
                  if (obj.CA10__routes__r[i4].result.status == 'INCOMPLIANT') {
                      count_CA10__routes__r_INCOMPLIANT3 += 1;
                  }
              }
          }
      }
      var count_CA10__routeTableAssociations__r_COMPLIANT2 = 0;
      if (obj.CA10__routeTableAssociations__r != null) {
          for (var i5 = 0; i5 < obj.CA10__routeTableAssociations__r.length; i5++) {
              if (typeof(obj.CA10__routeTableAssociations__r[i5].status) !== 'undefined') {
                  if (obj.CA10__routeTableAssociations__r[i5].status == 'COMPLIANT') {
                      count_CA10__routeTableAssociations__r_COMPLIANT2 += obj.CA10__routeTableAssociations__r[i5].count;
                  }
              } else  {
                  if (obj.CA10__routeTableAssociations__r[i5].result.status == 'COMPLIANT') {
                      count_CA10__routeTableAssociations__r_COMPLIANT2 += 1;
                  }
              }
          }
      }
      // condition[1], conditionIndex:[100..199]
      references1.push('Related list [CA10__routeTableAssociations__r] ' + (count_CA10__routeTableAssociations__r_COMPLIANT2 > 0 ? 'has' : 'does not have') + ' objects in COMPLIANT status');
      references1.push('Related list [CA10__routes__r] ' + (count_CA10__routes__r_INCOMPLIANT3 > 0 ? 'has' : 'does not have') + ' objects in INCOMPLIANT status');
      if (count_CA10__routeTableAssociations__r_COMPLIANT2 > 0 && count_CA10__routes__r_INCOMPLIANT3 > 0) {
          return {status: 'INCOMPLIANT', conditionIndex: 199, conditionText: "CA10__routeTableAssociations__r.has(COMPLIANT) && CA10__routes__r.has(INCOMPLIANT)", currentStateMessage: "This is a Main Route Table with an Internet Gateway route.", currentStateReferences: references1.join('\n'), remediation: "Consider removing this route.", runtimeError: null};
      }
      return {status: 'INAPPLICABLE', conditionIndex: 200, conditionText: "otherwise", currentStateMessage: "Custom Route Tables or Main Route Table without Internet Gateway.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;

  CREATE TEMP FUNCTION process_CA10__vpc__r_CA10__routeTables__r_CA10__routeTableAssociations__r(
      obj STRUCT<
          CA10__disappearanceTime__c TIMESTAMP,
          CA10__main__c BOOLEAN,
          CA10__routeTable__c STRING,
          Id STRING
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c);
      if (obj.CA10__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[1], conditionIndex:[100..199]
      function extract3() { if (!this.out) { this.out = obj.CA10__main__c; } return this.out; };
      references1.push('Main [obj.CA10__main__c]: ' + obj.CA10__main__c);
      if (extract3.call(extract3) == true) {
          return {status: 'COMPLIANT', conditionIndex: 199, conditionText: "extract('CA10__main__c') == true", currentStateMessage: "This is a Main Route Table.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      return {status: 'INAPPLICABLE', conditionIndex: 200, conditionText: "otherwise", currentStateMessage: "This is not a Main Route Table.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;

  CREATE TEMP FUNCTION process_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r_CA10__subnet__r_CA10__routeTableAssociations__r(
      obj STRUCT<
          CA10__disappearanceTime__c TIMESTAMP,
          CA10__subnet__c STRING,
          Id STRING,
          CA10__routeTable__c STRING,
          CA10__routeTable__r STRUCT<
              Id STRING,
              CA10__routes__r ARRAY<STRUCT<
                  CA10__disappearanceTime__c TIMESTAMP,
                  CA10__gatewayId__c STRING,
                  CA10__destinationCidrBlock__c STRING,
                  CA10__destinationIpv6CidrBlock__c STRING,
                  CA10__routeTable__c STRING,
                  Id STRING,
                  result STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
              >>
          >
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c);
      if (obj.CA10__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      var count_CA10__routeTable__r_CA10__routes__r_INCOMPLIANT2 = 0;
      if (obj.CA10__routeTable__r.CA10__routes__r != null) {
          for (var i3 = 0; i3 < obj.CA10__routeTable__r.CA10__routes__r.length; i3++) {
              if (typeof(obj.CA10__routeTable__r.CA10__routes__r[i3].status) !== 'undefined') {
                  if (obj.CA10__routeTable__r.CA10__routes__r[i3].status == 'INCOMPLIANT') {
                      count_CA10__routeTable__r_CA10__routes__r_INCOMPLIANT2 += obj.CA10__routeTable__r.CA10__routes__r[i3].count;
                  }
              } else  {
                  if (obj.CA10__routeTable__r.CA10__routes__r[i3].result.status == 'INCOMPLIANT') {
                      count_CA10__routeTable__r_CA10__routes__r_INCOMPLIANT2 += 1;
                  }
              }
          }
      }
      // condition[1], conditionIndex:[100..199]
      references1.push('Related list [CA10__routeTable__r.CA10__routes__r] ' + (count_CA10__routeTable__r_CA10__routes__r_INCOMPLIANT2 > 0 ? 'has' : 'does not have') + ' objects in INCOMPLIANT status');
      if (count_CA10__routeTable__r_CA10__routes__r_INCOMPLIANT2 > 0) {
          return {status: 'INCOMPLIANT', conditionIndex: 199, conditionText: "CA10__routeTable__r.CA10__routes__r.has(INCOMPLIANT)", currentStateMessage: "This subnet route table has an Internet Gateway route with unrestricted access.", currentStateReferences: references1.join('\n'), remediation: "Consider removing Internet Gateway routes with unrestricted access.", runtimeError: null};
      }
      return {status: 'COMPLIANT', conditionIndex: 200, conditionText: "otherwise", currentStateMessage: "This subnet is compliant", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;

  CREATE TEMP FUNCTION process_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r(
      obj STRUCT<
          CA10__disappearanceTime__c TIMESTAMP,
          CA10__subnetGroup__c STRING,
          Id STRING,
          CA10__subnet__c STRING,
          CA10__subnet__r STRUCT<
              Id STRING,
              CA10__routeTableAssociations__r ARRAY<STRUCT<
                  CA10__disappearanceTime__c TIMESTAMP,
                  CA10__subnet__c STRING,
                  Id STRING,
                  CA10__routeTable__c STRING,
                  CA10__routeTable__r STRUCT<
                      Id STRING,
                      CA10__routes__r ARRAY<STRUCT<
                          CA10__disappearanceTime__c TIMESTAMP,
                          CA10__gatewayId__c STRING,
                          CA10__destinationCidrBlock__c STRING,
                          CA10__destinationIpv6CidrBlock__c STRING,
                          CA10__routeTable__c STRING,
                          Id STRING,
                          result STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
                      >>
                  >,
                  result STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
              >>
          >
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c);
      if (obj.CA10__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      var count_CA10__subnet__r_CA10__routeTableAssociations__r_INCOMPLIANT2 = 0;
      if (obj.CA10__subnet__r.CA10__routeTableAssociations__r != null) {
          for (var i3 = 0; i3 < obj.CA10__subnet__r.CA10__routeTableAssociations__r.length; i3++) {
              if (typeof(obj.CA10__subnet__r.CA10__routeTableAssociations__r[i3].status) !== 'undefined') {
                  if (obj.CA10__subnet__r.CA10__routeTableAssociations__r[i3].status == 'INCOMPLIANT') {
                      count_CA10__subnet__r_CA10__routeTableAssociations__r_INCOMPLIANT2 += obj.CA10__subnet__r.CA10__routeTableAssociations__r[i3].count;
                  }
              } else  {
                  if (obj.CA10__subnet__r.CA10__routeTableAssociations__r[i3].result.status == 'INCOMPLIANT') {
                      count_CA10__subnet__r_CA10__routeTableAssociations__r_INCOMPLIANT2 += 1;
                  }
              }
          }
      }
      // condition[1], conditionIndex:[100..199]
      references1.push('Related list [CA10__subnet__r.CA10__routeTableAssociations__r] ' + (count_CA10__subnet__r_CA10__routeTableAssociations__r_INCOMPLIANT2 > 0 ? 'has' : 'does not have') + ' objects in INCOMPLIANT status');
      if (count_CA10__subnet__r_CA10__routeTableAssociations__r_INCOMPLIANT2 > 0) {
          return {status: 'INCOMPLIANT', conditionIndex: 199, conditionText: "CA10__subnet__r.CA10__routeTableAssociations__r.has(INCOMPLIANT)", currentStateMessage: "This Subnet Group has subnet route table with an Internet Gateway route with unrestricted access.", currentStateReferences: references1.join('\n'), remediation: "Consider removing Internet Gateway routes with unrestricted access.", runtimeError: null};
      }
      var count_CA10__subnet__r_CA10__routeTableAssociations__r_COMPLIANT4 = 0;
      if (obj.CA10__subnet__r.CA10__routeTableAssociations__r != null) {
          for (var i5 = 0; i5 < obj.CA10__subnet__r.CA10__routeTableAssociations__r.length; i5++) {
              if (typeof(obj.CA10__subnet__r.CA10__routeTableAssociations__r[i5].status) !== 'undefined') {
                  if (obj.CA10__subnet__r.CA10__routeTableAssociations__r[i5].status == 'COMPLIANT') {
                      count_CA10__subnet__r_CA10__routeTableAssociations__r_COMPLIANT4 += obj.CA10__subnet__r.CA10__routeTableAssociations__r[i5].count;
                  }
              } else  {
                  if (obj.CA10__subnet__r.CA10__routeTableAssociations__r[i5].result.status == 'COMPLIANT') {
                      count_CA10__subnet__r_CA10__routeTableAssociations__r_COMPLIANT4 += 1;
                  }
              }
          }
      }
      // condition[2], conditionIndex:[200..299]
      if (count_CA10__subnet__r_CA10__routeTableAssociations__r_COMPLIANT4 > 0) {
          return {status: 'COMPLIANT', conditionIndex: 299, conditionText: "CA10__subnet__r.CA10__routeTableAssociations__r.has(COMPLIANT)", currentStateMessage: "This Subnet Group has subnet route table with an Internet Gateway route with unrestricted access.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      return {status: 'INAPPLICABLE', conditionIndex: 300, conditionText: "otherwise", currentStateMessage: "This subnet group doesn't have route table associations.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;

  CREATE TEMP FUNCTION process_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r_CA10__subnet__r_CA10__routeTableAssociations__r_CA10__routeTable__r_CA10__routes__r(
      obj STRUCT<
          CA10__disappearanceTime__c TIMESTAMP,
          CA10__gatewayId__c STRING,
          CA10__destinationCidrBlock__c STRING,
          CA10__destinationIpv6CidrBlock__c STRING,
          CA10__routeTable__c STRING,
          Id STRING
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
  var TextLib = new function () {
      this.normalize = function(arg) {
          return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase();
      };
      this.isEmpty = function(arg) {
          return this.normalize(arg) == '';
      };
      this.isNotEmpty = function(arg) {
          return this.normalize(arg) != '';
      };
      this.equal = function(left, right) {
          return this.normalize(left) == this.normalize(right);
      };
      this.notEqual = function(left, right) {
          return this.normalize(left) != this.normalize(right);
      };
      this.startsWith = function(arg, substring) {
          return this.normalize(arg).startsWith(this.normalize(substring));
      };
      this.endsWith = function(arg, substring) {
          return this.normalize(arg).endsWith(this.normalize(substring));
      };
      this.contains = function(arg, substring) {
          return this.normalize(arg).includes(this.normalize(substring));
      };
      this.containsAll = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.every(sub => normalizedArg.includes(this.normalize(sub)));
      };
      this.containsAny = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.some(sub => normalizedArg.includes(this.normalize(sub)));
      };
  }();
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c);
      if (obj.CA10__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[1], conditionIndex:[100..199]
      function extract3() { if (!this.out) { this.out = obj.CA10__gatewayId__c; } return this.out; };
      function extract6() { if (!this.out) { this.out = obj.CA10__destinationCidrBlock__c; } return this.out; };
      function extract9() { if (!this.out) { this.out = obj.CA10__destinationIpv6CidrBlock__c; } return this.out; };
      references1.push('Internet Gateway ID [obj.CA10__gatewayId__c]: ' + obj.CA10__gatewayId__c);
      references1.push('Destination CIDR Block [obj.CA10__destinationCidrBlock__c]: ' + obj.CA10__destinationCidrBlock__c);
      references1.push('Destination IPv6 CIDR Block [obj.CA10__destinationIpv6CidrBlock__c]: ' + obj.CA10__destinationIpv6CidrBlock__c);
      if (TextLib.startsWith(extract3.call(extract3), 'igw') && (TextLib.equal(extract6.call(extract6), '0.0.0.0/0') || TextLib.equal(extract9.call(extract9), '::/0'))) {
          return {status: 'INCOMPLIANT', conditionIndex: 199, conditionText: "extract('CA10__gatewayId__c').startsWith('igw') && (extract('CA10__destinationCidrBlock__c') == '0.0.0.0/0' || extract('CA10__destinationIpv6CidrBlock__c') == '::/0')", currentStateMessage: "This is an Internet Gateway route with unrestricted access.", currentStateReferences: references1.join('\n'), remediation: "Consider removing this route.", runtimeError: null};
      }
      return {status: 'COMPLIANT', conditionIndex: 200, conditionText: "otherwise", currentStateMessage: "This is not an Internet Gateway Route.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;

  CREATE TEMP FUNCTION process_CA10__vpc__r_CA10__routeTables__r_CA10__routes__r(
      obj STRUCT<
          CA10__disappearanceTime__c TIMESTAMP,
          CA10__gatewayId__c STRING,
          CA10__destinationCidrBlock__c STRING,
          CA10__destinationIpv6CidrBlock__c STRING,
          CA10__routeTable__c STRING,
          Id STRING
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
  var TextLib = new function () {
      this.normalize = function(arg) {
          return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase();
      };
      this.isEmpty = function(arg) {
          return this.normalize(arg) == '';
      };
      this.isNotEmpty = function(arg) {
          return this.normalize(arg) != '';
      };
      this.equal = function(left, right) {
          return this.normalize(left) == this.normalize(right);
      };
      this.notEqual = function(left, right) {
          return this.normalize(left) != this.normalize(right);
      };
      this.startsWith = function(arg, substring) {
          return this.normalize(arg).startsWith(this.normalize(substring));
      };
      this.endsWith = function(arg, substring) {
          return this.normalize(arg).endsWith(this.normalize(substring));
      };
      this.contains = function(arg, substring) {
          return this.normalize(arg).includes(this.normalize(substring));
      };
      this.containsAll = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.every(sub => normalizedArg.includes(this.normalize(sub)));
      };
      this.containsAny = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.some(sub => normalizedArg.includes(this.normalize(sub)));
      };
  }();
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c);
      if (obj.CA10__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[1], conditionIndex:[100..199]
      function extract3() { if (!this.out) { this.out = obj.CA10__gatewayId__c; } return this.out; };
      function extract6() { if (!this.out) { this.out = obj.CA10__destinationCidrBlock__c; } return this.out; };
      function extract9() { if (!this.out) { this.out = obj.CA10__destinationIpv6CidrBlock__c; } return this.out; };
      references1.push('Internet Gateway ID [obj.CA10__gatewayId__c]: ' + obj.CA10__gatewayId__c);
      references1.push('Destination CIDR Block [obj.CA10__destinationCidrBlock__c]: ' + obj.CA10__destinationCidrBlock__c);
      references1.push('Destination IPv6 CIDR Block [obj.CA10__destinationIpv6CidrBlock__c]: ' + obj.CA10__destinationIpv6CidrBlock__c);
      if (TextLib.startsWith(extract3.call(extract3), 'igw') && (TextLib.equal(extract6.call(extract6), '0.0.0.0/0') || TextLib.equal(extract9.call(extract9), '::/0'))) {
          return {status: 'INCOMPLIANT', conditionIndex: 199, conditionText: "extract('CA10__gatewayId__c').startsWith('igw') && (extract('CA10__destinationCidrBlock__c') == '0.0.0.0/0' || extract('CA10__destinationIpv6CidrBlock__c') == '::/0')", currentStateMessage: "This is an Internet Gateway route.", currentStateReferences: references1.join('\n'), remediation: "Consider removing this route.", runtimeError: null};
      }
      return {status: 'COMPLIANT', conditionIndex: 200, conditionText: "otherwise", currentStateMessage: "This is not an Internet Gateway Route.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;


  SELECT
    expectedResult.Id as Id,
    IF (
      IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '')
      AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1)
      AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '')
      AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''),
      "MATCH",
      "FAIL"
    ) as match,
    expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus,
    expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex,
    expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText,
    expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError
  FROM UNNEST(mock_ExpectedResult()) expectedResult
  LEFT JOIN (
      SELECT
          sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
          sObject.CA10__publiclyAccessible__c AS CA10__publiclyAccessible__c,
          sObject.Id AS Id,
          sObject.CA10__subnetGroup__c AS CA10__subnetGroup__c,
          sObject.CA10__vpc__c AS CA10__vpc__c,
          STRUCT (
              `CA10__subnetGroup__r`.Id AS Id,
              `CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r`.arr AS CA10__AWS_RDS_Subnet_Group_Subnet_Links__r
          ) AS CA10__subnetGroup__r,
          STRUCT (
              `CA10__vpc__r`.Id AS Id,
              `CA10__vpc__r.CA10__routeTables__r`.arr AS CA10__routeTables__r
          ) AS CA10__vpc__r,
          process_CA10__CaAwsDbInstance__c(
              STRUCT(
                  sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                  sObject.CA10__publiclyAccessible__c AS CA10__publiclyAccessible__c,
                  sObject.Id AS Id,
                  sObject.CA10__subnetGroup__c AS CA10__subnetGroup__c,
                  sObject.CA10__vpc__c AS CA10__vpc__c,
                  STRUCT (
                      `CA10__subnetGroup__r`.Id AS Id,
                      `CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r`.arr AS CA10__AWS_RDS_Subnet_Group_Subnet_Links__r
                  ) AS CA10__subnetGroup__r,
                  STRUCT (
                      `CA10__vpc__r`.Id AS Id,
                      `CA10__vpc__r.CA10__routeTables__r`.arr AS CA10__routeTables__r
                  ) AS CA10__vpc__r
              ),
              sObject.context.snapshotTime
          ) as result
      FROM UNNEST(mock_CA10__CaAwsDbInstance__c()) AS sObject
      LEFT JOIN UNNEST(mock_CA10__CaAwsDbSubnetGroup__c()) AS `CA10__subnetGroup__r`
          ON sObject.CA10__subnetGroup__c = `CA10__subnetGroup__r`.Id
      LEFT JOIN UNNEST(mock_CA10__CaAwsVpc__c()) AS `CA10__vpc__r`
          ON sObject.CA10__vpc__c = `CA10__vpc__r`.Id
      LEFT JOIN (
          SELECT
              sObject.CA10__subnetGroup__c,
              ARRAY_AGG(
                  STRUCT(
                      sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                      sObject.CA10__subnetGroup__c AS CA10__subnetGroup__c,
                      sObject.Id AS Id,
                      sObject.CA10__subnet__c AS CA10__subnet__c,
                      STRUCT (
                          `CA10__subnet__r`.Id AS Id,
                          `CA10__subnet__r.CA10__routeTableAssociations__r`.arr AS CA10__routeTableAssociations__r
                      ) AS CA10__subnet__r,
                      process_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r(
                          STRUCT(
                              sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                              sObject.CA10__subnetGroup__c AS CA10__subnetGroup__c,
                              sObject.Id AS Id,
                              sObject.CA10__subnet__c AS CA10__subnet__c,
                              STRUCT (
                                  `CA10__subnet__r`.Id AS Id,
                                  `CA10__subnet__r.CA10__routeTableAssociations__r`.arr AS CA10__routeTableAssociations__r
                              ) AS CA10__subnet__r
                          ),
                          sObject.context.snapshotTime
                      ) as result
                  )
              ) AS arr
          FROM UNNEST(mock_CA10__CaAwsDbSubnetGroupSubnetLink__c()) AS sObject
          LEFT JOIN UNNEST(mock_CA10__CaAwsSubnet__c()) AS `CA10__subnet__r`
              ON sObject.CA10__subnet__c = `CA10__subnet__r`.Id
          LEFT JOIN (
              SELECT
                  sObject.CA10__subnet__c,
                  ARRAY_AGG(
                      STRUCT(
                          sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                          sObject.CA10__subnet__c AS CA10__subnet__c,
                          sObject.Id AS Id,
                          sObject.CA10__routeTable__c AS CA10__routeTable__c,
                          STRUCT (
                              `CA10__routeTable__r`.Id AS Id,
                              `CA10__routeTable__r.CA10__routes__r`.arr AS CA10__routes__r
                          ) AS CA10__routeTable__r,
                          process_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r_CA10__subnet__r_CA10__routeTableAssociations__r(
                              STRUCT(
                                  sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                                  sObject.CA10__subnet__c AS CA10__subnet__c,
                                  sObject.Id AS Id,
                                  sObject.CA10__routeTable__c AS CA10__routeTable__c,
                                  STRUCT (
                                      `CA10__routeTable__r`.Id AS Id,
                                      `CA10__routeTable__r.CA10__routes__r`.arr AS CA10__routes__r
                                  ) AS CA10__routeTable__r
                              ),
                              sObject.context.snapshotTime
                          ) as result
                      )
                  ) AS arr
              FROM UNNEST(mock_CA10__CaAwsRouteTableAssociation__c()) AS sObject
              LEFT JOIN UNNEST(mock_CA10__CaAwsRouteTable__c()) AS `CA10__routeTable__r`
                  ON sObject.CA10__routeTable__c = `CA10__routeTable__r`.Id
              LEFT JOIN (
                  SELECT
                      sObject.CA10__routeTable__c,
                      ARRAY_AGG(
                          STRUCT(
                              sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                              sObject.CA10__gatewayId__c AS CA10__gatewayId__c,
                              sObject.CA10__destinationCidrBlock__c AS CA10__destinationCidrBlock__c,
                              sObject.CA10__destinationIpv6CidrBlock__c AS CA10__destinationIpv6CidrBlock__c,
                              sObject.CA10__routeTable__c AS CA10__routeTable__c,
                              sObject.Id AS Id,
                              process_CA10__subnetGroup__r_CA10__AWS_RDS_Subnet_Group_Subnet_Links__r_CA10__subnet__r_CA10__routeTableAssociations__r_CA10__routeTable__r_CA10__routes__r(
                                  STRUCT(
                                      sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                                      sObject.CA10__gatewayId__c AS CA10__gatewayId__c,
                                      sObject.CA10__destinationCidrBlock__c AS CA10__destinationCidrBlock__c,
                                      sObject.CA10__destinationIpv6CidrBlock__c AS CA10__destinationIpv6CidrBlock__c,
                                      sObject.CA10__routeTable__c AS CA10__routeTable__c,
                                      sObject.Id AS Id
                                  ),
                                  sObject.context.snapshotTime
                              ) as result
                          )
                      ) AS arr
                  FROM UNNEST(mock_CA10__CaAwsRoute__c()) AS sObject
                  GROUP BY sObject.CA10__routeTable__c
              ) AS `CA10__routeTable__r.CA10__routes__r`
                  ON `CA10__routeTable__r`.Id = `CA10__routeTable__r.CA10__routes__r`.CA10__routeTable__c
              GROUP BY sObject.CA10__subnet__c
          ) AS `CA10__subnet__r.CA10__routeTableAssociations__r`
              ON `CA10__subnet__r`.Id = `CA10__subnet__r.CA10__routeTableAssociations__r`.CA10__subnet__c
          GROUP BY sObject.CA10__subnetGroup__c
      ) AS `CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r`
          ON `CA10__subnetGroup__r`.Id = `CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r`.CA10__subnetGroup__c
      LEFT JOIN (
          SELECT
              sObject.CA10__vpc__c,
              ARRAY_AGG(
                  STRUCT(
                      sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                      sObject.CA10__vpc__c AS CA10__vpc__c,
                      sObject.Id AS Id,
                      `CA10__routeTableAssociations__r`.arr AS CA10__routeTableAssociations__r,
                      `CA10__routes__r`.arr AS CA10__routes__r,
                      process_CA10__vpc__r_CA10__routeTables__r(
                          STRUCT(
                              sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                              sObject.CA10__vpc__c AS CA10__vpc__c,
                              sObject.Id AS Id,
                              `CA10__routeTableAssociations__r`.arr AS CA10__routeTableAssociations__r,
                              `CA10__routes__r`.arr AS CA10__routes__r
                          ),
                          sObject.context.snapshotTime
                      ) as result
                  )
              ) AS arr
          FROM UNNEST(mock_CA10__CaAwsRouteTable__c()) AS sObject
          LEFT JOIN (
              SELECT
                  sObject.CA10__routeTable__c,
                  ARRAY_AGG(
                      STRUCT(
                          sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                          sObject.CA10__main__c AS CA10__main__c,
                          sObject.CA10__routeTable__c AS CA10__routeTable__c,
                          sObject.Id AS Id,
                          process_CA10__vpc__r_CA10__routeTables__r_CA10__routeTableAssociations__r(
                              STRUCT(
                                  sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                                  sObject.CA10__main__c AS CA10__main__c,
                                  sObject.CA10__routeTable__c AS CA10__routeTable__c,
                                  sObject.Id AS Id
                              ),
                              sObject.context.snapshotTime
                          ) as result
                      )
                  ) AS arr
              FROM UNNEST(mock_CA10__CaAwsRouteTableAssociation__c()) AS sObject
              GROUP BY sObject.CA10__routeTable__c
          ) AS `CA10__routeTableAssociations__r`
              ON sObject.Id = `CA10__routeTableAssociations__r`.CA10__routeTable__c
          LEFT JOIN (
              SELECT
                  sObject.CA10__routeTable__c,
                  ARRAY_AGG(
                      STRUCT(
                          sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                          sObject.CA10__gatewayId__c AS CA10__gatewayId__c,
                          sObject.CA10__destinationCidrBlock__c AS CA10__destinationCidrBlock__c,
                          sObject.CA10__destinationIpv6CidrBlock__c AS CA10__destinationIpv6CidrBlock__c,
                          sObject.CA10__routeTable__c AS CA10__routeTable__c,
                          sObject.Id AS Id,
                          process_CA10__vpc__r_CA10__routeTables__r_CA10__routes__r(
                              STRUCT(
                                  sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                                  sObject.CA10__gatewayId__c AS CA10__gatewayId__c,
                                  sObject.CA10__destinationCidrBlock__c AS CA10__destinationCidrBlock__c,
                                  sObject.CA10__destinationIpv6CidrBlock__c AS CA10__destinationIpv6CidrBlock__c,
                                  sObject.CA10__routeTable__c AS CA10__routeTable__c,
                                  sObject.Id AS Id
                              ),
                              sObject.context.snapshotTime
                          ) as result
                      )
                  ) AS arr
              FROM UNNEST(mock_CA10__CaAwsRoute__c()) AS sObject
              GROUP BY sObject.CA10__routeTable__c
          ) AS `CA10__routes__r`
              ON sObject.Id = `CA10__routes__r`.CA10__routeTable__c
          GROUP BY sObject.CA10__vpc__c
      ) AS `CA10__vpc__r.CA10__routeTables__r`
          ON `CA10__vpc__r`.Id = `CA10__vpc__r.CA10__routeTables__r`.CA10__vpc__c
  ) sObject ON sObject.Id = expectedResult.Id;
