---
policy: /ce/ca/azure/postgresql-database/single-server-enforce-ssl-connection
logic: /ce/ca/azure/postgresql-database/single-server-enforce-ssl-connection/prod.logic.yaml
executionTime: 2025-05-10T12:03:01.709327585Z
rows:
  - id: test1
    match: true
    status:
      expected: DISAPPEARED
      actual: DISAPPEARED
    conditionIndex:
      expected: 99
      actual: 99
    conditionText:
      expected: isDisappeared(CA10Z1__disappearanceTime__c)
      actual: isDisappeared(CA10Z1__disappearanceTime__c)
    runtimeError: {}
  - id: test2
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 299
      actual: 299
    conditionText:
      expected: extract('CA10Z1__sslEnforcement__c') == 'Disabled'
      actual: extract('CA10Z1__sslEnforcement__c') == 'Disabled'
    runtimeError: {}
  - id: test3
    match: true
    status:
      expected: COMPLIANT
      actual: COMPLIANT
    conditionIndex:
      expected: 399
      actual: 399
    conditionText:
      expected: extract('CA10Z1__sslEnforcement__c') == 'Enabled'
      actual: extract('CA10Z1__sslEnforcement__c') == 'Enabled'
    runtimeError: {}
  - id: test4
    match: true
    status:
      expected: UNDETERMINED
      actual: UNDETERMINED
    conditionIndex:
      expected: 201
      actual: 201
    conditionText:
      expected: CA10Z1__sslEnforcement__c.isEmpty()
      actual: CA10Z1__sslEnforcement__c.isEmpty()
    runtimeError: {}
  - id: test5
    match: true
    status:
      expected: INAPPLICABLE
      actual: INAPPLICABLE
    conditionIndex:
      expected: 199
      actual: 199
    conditionText:
      expected: extract('CA10Z1__deploymentMode__c') != 'Single'
      actual: extract('CA10Z1__deploymentMode__c') != 'Single'
    runtimeError: {}
usedFiles:
  - path: /ce/ca/azure/postgresql-database/single-server-enforce-ssl-connection/policy.yaml
    md5Hash: 2B5EC94AC3B6530C8BFFF9B5F06DDF97
    content: |
      ---
      names:
        full: Azure PostgreSQL Single Server Enforce SSL Connection is not set enabled
        contextual: Single Server Enforce SSL Connection is not set enabled
      description: SSL connectivity helps to provide a new layer of security by connecting
        database server to client applications using Secure Sockets Layer (SSL). Enforcing
        SSL connections between database server and client applications helps protect against
        'man in the middle' attacks by encrypting the data stream between the server and
        application.
      type: COMPLIANCE_POLICY
      categories:
        - SECURITY
      frameworkMappings:
        - "/frameworks/cis-azure-v2.1.0/04/03/01"
        - "/frameworks/cloudaware/resource-security/data-encryption"
      similarPolicies:
        internal:
          - dec-x-995424b7
        cloudConformity:
          - url: https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/PostgreSQL/in-transit-encryption.html
            name: Enable In-Transit Encryption for PostgreSQL Database Servers
  - path: /ce/ca/azure/postgresql-database/single-server-enforce-ssl-connection/prod.logic.yaml
    md5Hash: 5739F6568DDA1649BF17810EE7B5D569
    content: |-
      ---
      inputType: "CA10Z1__CaAzurePostgreSqlServer__c"
      testData:
        - file: "test-data.json"
      importExtracts:
        - file: "/types/CA10Z1__CaAzurePostgreSqlServer__c/object.extracts.yaml"
      conditions:
        - status: "INAPPLICABLE"
          currentStateMessage: "This is not a Single Server deployment mode."
          check:
            NOT_EQUAL:
              left:
                EXTRACT: "CA10Z1__deploymentMode__c"
              right:
                TEXT: "Single"
        - status: "INCOMPLIANT"
          currentStateMessage: "PostgreSQL Server SSL Enforcement is disabled."
          remediationMessage: "Consider enabling PostgreSQL Server SSL Enforcement."
          check:
            IS_EQUAL:
              left:
                EXTRACT: "CA10Z1__sslEnforcement__c"
              right:
                TEXT: "Disabled"
        - status: "COMPLIANT"
          currentStateMessage: "PostgreSQL Server SSL Enforcement is enabled."
          check:
            IS_EQUAL:
              left:
                EXTRACT: "CA10Z1__sslEnforcement__c"
              right:
                TEXT: "Enabled"
      otherwise:
        status: "UNDETERMINED"
        currentStateMessage: "Unexpected value in the field."
  - path: /types/CA10Z1__CaAzurePostgreSqlServer__c/object.extracts.yaml
    md5Hash: 08BBA6DB6D72395AA7E05F67B74F9223
    content: "---\nextracts:\n# Values: Enabled, Disabled. Not Nullable. Can't have\
      \ no access, retrieved via Microsoft.DBforPostgreSQL/servers/read\n  - name:\
      \ \"CA10Z1__sslEnforcement__c\"\n    value: \n      FIELD:\n        path: \"\
      CA10Z1__sslEnforcement__c\"\n        undeterminedIf:\n          isEmpty: \"\
      Corrupted Data. PostgreSQL Server SSL Enforcement cannot be empty.\"\n# Values:\
      \ Enabled, Disabled. Not Nullable. Can't have no access, retrieved via Microsoft.DBforPostgreSQL/servers/read\n\
      \  - name: \"CA10Z1__infrastructureEncryption__c\"\n    value: \n      FIELD:\n\
      \        path: \"CA10Z1__infrastructureEncryption__c\"\n        undeterminedIf:\n\
      \          isEmpty: \"Corrupted Data. PostgreSQL Server Infrastructure Encryption\
      \ cannot be empty.\"\n# Not nullable\n  - name: \"CA10Z1__configurations__c\"\
      \n    value:\n      FIELD:\n        path: \"CA10Z1__configurations__c\"\n  \
      \      returnType: BYTES\n        undeterminedIf:\n          noAccessDelegate:\n\
      \            path: \"CA10Z1__configurations__c\"\n            currentStateMessage:\
      \ \"Unable to determine Server Configurations. Possible permission issue with\
      \ Microsoft.DBforPostgreSQL/servers/configurations/read\"\n  - name: \"caJsonFrom__configurations__c\"\
      \n    value: \n      JSON_FROM:\n        arg: \n          EXTRACT: \"CA10Z1__configurations__c\"\
      \n        undeterminedIf:\n          isInvalid: \"Configurations JSON is invalid.\"\
      \n  - name: \"CA10Z1__firewallRules__c\"\n    value: \n      FIELD:\n      \
      \  path: \"CA10Z1__firewallRules__c\"\n        returnType: BYTES\n        undeterminedIf:\n\
      \          noAccessDelegate:\n            path: \"CA10Z1__firewallRules__c\"\
      \n            currentStateMessage: \"Unable to determine Firewall Rules. Possible\
      \ permission issue with Microsoft.Sql/servers/firewallRules/read\"\n  - name:\
      \ \"caJsonFrom__firewallRules__c\"\n    value: \n      JSON_FROM:\n        arg:\
      \ \n          EXTRACT: \"CA10Z1__firewallRules__c\"\n        undeterminedIf:\n\
      \          isInvalid: \"Firewall Rules JSON is invalid.\"\n  - name: \"CA10Z1__deploymentMode__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10Z1__deploymentMode__c\"\n \
      \       undeterminedIf:\n          isEmpty: \"Corrupted Data. PostgreSQL Deployment\
      \ Mode cannot be empty.\"\n\n"
  - path: /ce/ca/azure/postgresql-database/single-server-enforce-ssl-connection/test-data.json
    md5Hash: 1CC78F0663821DB275103D31D28B9DE6
    content: |-
      [
          {
              "expectedResult": {
                  "status": "DISAPPEARED",
                  "conditionIndex": "99",
                  "conditionText": "isDisappeared(CA10Z1__disappearanceTime__c)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-06-13T04:17:29Z"
              },
              "Id": "test1",
              "CA10Z1__disappearanceTime__c": "2024-06-13T04:17:29Z",
              "CA10Z1__sslEnforcement__c": "Enabled",
              "CA10Z1__deploymentMode__c": "Single"
          },
          {
              "expectedResult": {
                  "status": "INCOMPLIANT",
                  "conditionIndex": "299",
                  "conditionText": "extract('CA10Z1__sslEnforcement__c') == 'Disabled'",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-06-13T04:17:29Z"
              },
              "Id": "test2",
              "CA10Z1__disappearanceTime__c": null,
              "CA10Z1__sslEnforcement__c": "Disabled",
              "CA10Z1__deploymentMode__c": "Single"
          },
          {
              "expectedResult": {
                  "status": "COMPLIANT",
                  "conditionIndex": "399",
                  "conditionText": "extract('CA10Z1__sslEnforcement__c') == 'Enabled'",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-06-13T04:17:29Z"
              },
              "Id": "test3",
              "CA10Z1__disappearanceTime__c": null,
              "CA10Z1__sslEnforcement__c": "Enabled",
              "CA10Z1__deploymentMode__c": "Single"
          },
          {
              "expectedResult": {
                  "status": "UNDETERMINED",
                  "conditionIndex": "201",
                  "conditionText": "CA10Z1__sslEnforcement__c.isEmpty()",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-06-13T04:17:29Z"
              },
              "Id": "test4",
              "CA10Z1__disappearanceTime__c": null,
              "CA10Z1__sslEnforcement__c": "",
              "CA10Z1__deploymentMode__c": "Single"
          },
          {
          "expectedResult":{
              "status": "INAPPLICABLE",
              "conditionIndex": "199",
              "conditionText": "extract('CA10Z1__deploymentMode__c') != 'Single'",
              "runtimeError": null
          },
              "context":{
                  "snapshotTime": "2024-06-13T04:17:29Z"
              },
              "Id": "test5",
              "CA10Z1__disappearanceTime__c": null,
              "CA10Z1__sslEnforcement__c": "Enabled",
              "CA10Z1__deploymentMode__c": "Flexible"
          }
      ]
script: |-
  CREATE TEMP FUNCTION mock_ExpectedResult()
  RETURNS ARRAY<STRUCT<
          Id STRING,
          expectedResult STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, runtimeError STRING>
      >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "Id" : "test1",
    "expectedResult" : {
      "status" : "DISAPPEARED",
      "conditionIndex" : "99",
      "conditionText" : "isDisappeared(CA10Z1__disappearanceTime__c)",
      "runtimeError" : null
    }
  }, {
    "Id" : "test2",
    "expectedResult" : {
      "status" : "INCOMPLIANT",
      "conditionIndex" : "299",
      "conditionText" : "extract('CA10Z1__sslEnforcement__c') == 'Disabled'",
      "runtimeError" : null
    }
  }, {
    "Id" : "test3",
    "expectedResult" : {
      "status" : "COMPLIANT",
      "conditionIndex" : "399",
      "conditionText" : "extract('CA10Z1__sslEnforcement__c') == 'Enabled'",
      "runtimeError" : null
    }
  }, {
    "Id" : "test4",
    "expectedResult" : {
      "status" : "UNDETERMINED",
      "conditionIndex" : "201",
      "conditionText" : "CA10Z1__sslEnforcement__c.isEmpty()",
      "runtimeError" : null
    }
  }, {
    "Id" : "test5",
    "expectedResult" : {
      "status" : "INAPPLICABLE",
      "conditionIndex" : "199",
      "conditionText" : "extract('CA10Z1__deploymentMode__c') != 'Single'",
      "runtimeError" : null
    }
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10Z1__CaAzurePostgreSqlServer__c()
  RETURNS ARRAY<STRUCT<
      Id STRING,
      CA10Z1__disappearanceTime__c TIMESTAMP,
      CA10Z1__deploymentMode__c STRING,
      CA10Z1__sslEnforcement__c STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2024-06-13T04:17:29Z")
    },
    "Id" : "test1",
    "CA10Z1__disappearanceTime__c" : new Date("2024-06-13T04:17:29Z"),
    "CA10Z1__deploymentMode__c" : "Single",
    "CA10Z1__sslEnforcement__c" : "Enabled"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-06-13T04:17:29Z")
    },
    "Id" : "test2",
    "CA10Z1__deploymentMode__c" : "Single",
    "CA10Z1__sslEnforcement__c" : "Disabled"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-06-13T04:17:29Z")
    },
    "Id" : "test3",
    "CA10Z1__deploymentMode__c" : "Single",
    "CA10Z1__sslEnforcement__c" : "Enabled"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-06-13T04:17:29Z")
    },
    "Id" : "test4",
    "CA10Z1__deploymentMode__c" : "Single",
    "CA10Z1__sslEnforcement__c" : ""
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-06-13T04:17:29Z")
    },
    "Id" : "test5",
    "CA10Z1__deploymentMode__c" : "Flexible",
    "CA10Z1__sslEnforcement__c" : "Enabled"
  } ];
  """;

  CREATE TEMP FUNCTION process_CA10Z1__CaAzurePostgreSqlServer__c(
      obj STRUCT<
          Id STRING,
          CA10Z1__disappearanceTime__c TIMESTAMP,
          CA10Z1__deploymentMode__c STRING,
          CA10Z1__sslEnforcement__c STRING
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
      var TextLib = new function () {
          this.normalize = function(arg) {
              return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase();
          };
          this.isEmpty = function(arg) {
              return this.normalize(arg) == '';
          };
          this.isNotEmpty = function(arg) {
              return this.normalize(arg) != '';
          };
          this.equal = function(left, right) {
              return this.normalize(left) == this.normalize(right);
          };
          this.notEqual = function(left, right) {
              return this.normalize(left) != this.normalize(right);
          };
          this.startsWith = function(arg, substring) {
              return this.normalize(arg).startsWith(this.normalize(substring));
          };
          this.endsWith = function(arg, substring) {
              return this.normalize(arg).endsWith(this.normalize(substring));
          };
          this.contains = function(arg, substring) {
              return this.normalize(arg).includes(this.normalize(substring));
          };
      }();
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From Azure [CA10Z1__disappearanceTime__c]: ' + obj.CA10Z1__disappearanceTime__c);
      if (obj.CA10Z1__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10Z1__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[1], conditionIndex:[100..199]
      function fieldChecked4() {
          if (TextLib.isEmpty(obj.CA10Z1__deploymentMode__c)) {
              throw new Error("UNDETERMINED condition:101", {cause: {status: 'UNDETERMINED', conditionIndex: 101, conditionText: "CA10Z1__deploymentMode__c.isEmpty()", currentStateMessage: "Corrupted Data. PostgreSQL Deployment Mode cannot be empty.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          return obj.CA10Z1__deploymentMode__c;
      }
      function extract3() { if (!this.out) { this.out = fieldChecked4(); } return this.out; };
      references1.push('Deployment Mode [obj.CA10Z1__deploymentMode__c]: ' + obj.CA10Z1__deploymentMode__c);
      try {
          if (TextLib.notEqual(extract3.call(extract3), 'Single')) {
              return {status: 'INAPPLICABLE', conditionIndex: 199, conditionText: "extract('CA10Z1__deploymentMode__c') != 'Single'", currentStateMessage: "This is not a Single Server deployment mode.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
          }
      } catch (err) {
          if (err.cause && err.cause.status) { return err.cause; } else { throw err; }
      }
      // condition[2], conditionIndex:[200..299]
      function fieldChecked7() {
          if (TextLib.isEmpty(obj.CA10Z1__sslEnforcement__c)) {
              throw new Error("UNDETERMINED condition:201", {cause: {status: 'UNDETERMINED', conditionIndex: 201, conditionText: "CA10Z1__sslEnforcement__c.isEmpty()", currentStateMessage: "Corrupted Data. PostgreSQL Server SSL Enforcement cannot be empty.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          return obj.CA10Z1__sslEnforcement__c;
      }
      function extract6() { if (!this.out) { this.out = fieldChecked7(); } return this.out; };
      references1.push('SSL Enforcement [obj.CA10Z1__sslEnforcement__c]: ' + obj.CA10Z1__sslEnforcement__c);
      try {
          if (TextLib.equal(extract6.call(extract6), 'Disabled')) {
              return {status: 'INCOMPLIANT', conditionIndex: 299, conditionText: "extract('CA10Z1__sslEnforcement__c') == 'Disabled'", currentStateMessage: "PostgreSQL Server SSL Enforcement is disabled.", currentStateReferences: references1.join('\n'), remediation: "Consider enabling PostgreSQL Server SSL Enforcement.", runtimeError: null};
          }
      } catch (err) {
          if (err.cause && err.cause.status) { return err.cause; } else { throw err; }
      }
      // condition[3], conditionIndex:[300..399]
      function fieldChecked10() {
          if (TextLib.isEmpty(obj.CA10Z1__sslEnforcement__c)) {
              throw new Error("UNDETERMINED condition:301", {cause: {status: 'UNDETERMINED', conditionIndex: 301, conditionText: "CA10Z1__sslEnforcement__c.isEmpty()", currentStateMessage: "Corrupted Data. PostgreSQL Server SSL Enforcement cannot be empty.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          return obj.CA10Z1__sslEnforcement__c;
      }
      function extract9() { if (!this.out) { this.out = fieldChecked10(); } return this.out; };
      try {
          if (TextLib.equal(extract9.call(extract9), 'Enabled')) {
              return {status: 'COMPLIANT', conditionIndex: 399, conditionText: "extract('CA10Z1__sslEnforcement__c') == 'Enabled'", currentStateMessage: "PostgreSQL Server SSL Enforcement is enabled.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
          }
      } catch (err) {
          if (err.cause && err.cause.status) { return err.cause; } else { throw err; }
      }
      return {status: 'UNDETERMINED', conditionIndex: 400, conditionText: "otherwise", currentStateMessage: "Unexpected value in the field.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;


  SELECT
    expectedResult.Id as Id,
    IF (
      IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '')
      AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1)
      AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '')
      AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''),
      "MATCH",
      "FAIL"
    ) as match,
    expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus,
    expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex,
    expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText,
    expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError
  FROM UNNEST(mock_ExpectedResult()) expectedResult
  LEFT JOIN (
      SELECT
          sObject.Id AS Id,
          sObject.CA10Z1__disappearanceTime__c AS CA10Z1__disappearanceTime__c,
          sObject.CA10Z1__deploymentMode__c AS CA10Z1__deploymentMode__c,
          sObject.CA10Z1__sslEnforcement__c AS CA10Z1__sslEnforcement__c,
          process_CA10Z1__CaAzurePostgreSqlServer__c(
              STRUCT(
                  sObject.Id AS Id,
                  sObject.CA10Z1__disappearanceTime__c AS CA10Z1__disappearanceTime__c,
                  sObject.CA10Z1__deploymentMode__c AS CA10Z1__deploymentMode__c,
                  sObject.CA10Z1__sslEnforcement__c AS CA10Z1__sslEnforcement__c
              ),
              sObject.context.snapshotTime
          ) as result
      FROM UNNEST(mock_CA10Z1__CaAzurePostgreSqlServer__c()) AS sObject
  ) sObject ON sObject.Id = expectedResult.Id;
