--- policy: /ce/ca/azure/databricks/network-security-groups-for-subnets logic: /ce/ca/azure/databricks/network-security-groups-for-subnets/prod.logic.yaml executionTime: 2026-06-06T12:03:34.721710707Z generationMs: 108 executionMs: 1387 rows: - id: '001' match: true status: expected: DISAPPEARED actual: DISAPPEARED conditionIndex: expected: 99 actual: 99 conditionText: expected: isDisappeared(CA10Z1__disappearanceTime__c) actual: isDisappeared(CA10Z1__disappearanceTime__c) runtimeError: {} - id: '002' match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 299 actual: 299 conditionText: expected: isEmptyLookup('CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r') && isEmptyLookup('CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r') actual: isEmptyLookup('CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r') && isEmptyLookup('CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r') runtimeError: {} - id: '003' match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 399 actual: 399 conditionText: expected: isEmptyLookup('CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r') actual: isEmptyLookup('CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r') runtimeError: {} - id: '004' match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 499 actual: 499 conditionText: expected: isEmptyLookup('CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r') actual: isEmptyLookup('CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r') runtimeError: {} - id: '005' match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 500 actual: 500 conditionText: expected: otherwise actual: otherwise runtimeError: {} usedFiles: - path: /ce/ca/azure/databricks/network-security-groups-for-subnets/policy.yaml md5Hash: F6CF6F0D456248DA6A63A0CE32BD1444 content: | --- names: full: Azure Databricks Workspace network security groups are not configured contextual: Databricks Workspace network security groups are not configured description: "Network Security Groups (NSGs) should be implemented to control inbound and\ \ outbound traffic to Azure Databricks subnets, ensuring only authorized communication.\ \ NSGs should be configured with deny rules to block unwanted traffic and restrict\ \ communication to essential sources only." type: COMPLIANCE_POLICY categories: - SECURITY frameworkMappings: - "/frameworks/cis-azure-v6.0.0/02/01/02" - "/frameworks/cloudaware/resource-security/network-exposure" - path: /ce/ca/azure/databricks/network-security-groups-for-subnets/prod.logic.yaml md5Hash: 08EEBE7E24B27AACEE3ABA7EC5CD85CF content: | --- inputType: "CA10Z1__CaAzureDatabricksWorkspace__c" testData: - file: "test-data.json" importExtracts: - file: "/types/CA10Z1__CaAzureDatabricksWorkspace__c/object.extracts.yaml" conditions: - status: "INAPPLICABLE" currentStateMessage: "The Databricks workspace is not deployed in a customer-managed virtual network." check: IS_EMPTY: arg: EXTRACT: "caJsonText__parametersJsonCustomVirtualNetworkValue__c" - status: "INCOMPLIANT" currentStateMessage: "The Databricks workspace network subnets do not have NSGs assigned." remediationMessage: "Assign NSGs to the subnets." check: AND: args: - IS_EMPTY_LOOKUP: "CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r" - IS_EMPTY_LOOKUP: "CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r" - status: "INCOMPLIANT" currentStateMessage: "The Databricks workspace private subnet does not have an NSG assigned." remediationMessage: "Assign an NSG to the subnet." check: IS_EMPTY_LOOKUP: "CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r" - status: "INCOMPLIANT" currentStateMessage: "The Databricks workspace public subnet does not have an NSG assigned." remediationMessage: "Assign an NSG to the subnet." check: IS_EMPTY_LOOKUP: "CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r" otherwise: status: "COMPLIANT" currentStateMessage: "The Databricks workspace is configured with a VNet." - path: /ce/ca/azure/databricks/network-security-groups-for-subnets/test-data.json md5Hash: 925716927036D26F09A26596BDCF2265 content: | [ { "expectedResult": { "status": "DISAPPEARED", "conditionIndex": "99", "conditionText": "isDisappeared(CA10Z1__disappearanceTime__c)", "runtimeError": null }, "context": { "snapshotTime": "2025-11-19T07:17:23Z" }, "CA10Z1__disappearanceTime__c": "2025-11-13T16:22:07Z", "CA10Z1__privateNetworkSubnet__c": "", "CA10Z1__privateNetworkSubnetId__c": "/subscriptions/resourcegroups/providers/subnets/001-1", "CA10Z1__publicNetworkSubnet__c": "", "CA10Z1__publicNetworkSubnetId__c": "/subscriptions/resourcegroups/providers/subnets/001-2", "Id": "001", "CA10Z1__privateNetworkSubnet__r": { "CA10__disappearanceTime__c": null, "CA10__networkSecurityGroup__c": null, "CA10__networkSecurityGroupId__c": null, "Id": null, "CA10__networkSecurityGroup__r": { "Id": null, "CA10__disappearanceTime__c": null } }, "CA10Z1__publicNetworkSubnet__r": { "CA10__disappearanceTime__c": null, "CA10__networkSecurityGroup__c": null, "CA10__networkSecurityGroupId__c": null, "Id": null, "CA10__networkSecurityGroup__r": { "Id": null, "CA10__disappearanceTime__c": null } } }, { "expectedResult": { "status": "INCOMPLIANT", "conditionIndex": "299", "conditionText": "isEmptyLookup('CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r') && isEmptyLookup('CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r')", "runtimeError": null }, "context": { "snapshotTime": "2025-11-19T07:17:23Z" }, "CA10Z1__disappearanceTime__c": null, "CA10Z1__parametersJson__c": "{\"customVirtualNetworkId\":{\"type\":\"STRING\",\"value\":\"/subscriptions/8064/resourceGroups/AZ-Network/providers/Microsoft.Network/virtualNetworks/AZ-prd\"},\"customPublicSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"customPrivateSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"enableNoPublicIp\":{\"type\":\"BOOL\",\"value\":false}}", "CA10Z1__privateNetworkSubnet__c": "", "CA10Z1__privateNetworkSubnetId__c": "", "CA10Z1__publicNetworkSubnet__c": "", "CA10Z1__publicNetworkSubnetId__c": "", "Id": "002", "CA10Z1__privateNetworkSubnet__r": { "CA10__disappearanceTime__c": null, "CA10__networkSecurityGroup__c": null, "CA10__networkSecurityGroupId__c": null, "Id": null, "CA10__networkSecurityGroup__r": { "Id": null, "CA10__disappearanceTime__c": null } }, "CA10Z1__publicNetworkSubnet__r": { "CA10__disappearanceTime__c": null, "CA10__networkSecurityGroup__c": null, "CA10__networkSecurityGroupId__c": null, "Id": null, "CA10__networkSecurityGroup__r": { "Id": null, "CA10__disappearanceTime__c": null } } }, { "expectedResult": { "status": "INCOMPLIANT", "conditionIndex": "399", "conditionText": "isEmptyLookup('CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r')", "runtimeError": null }, "context": { "snapshotTime": "2025-11-19T07:17:23Z" }, "CA10Z1__disappearanceTime__c": null, "CA10Z1__parametersJson__c": "{\"customVirtualNetworkId\":{\"type\":\"STRING\",\"value\":\"/subscriptions/8064/resourceGroups/AZ-Network/providers/Microsoft.Network/virtualNetworks/AZ-prd\"},\"customPublicSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"customPrivateSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"enableNoPublicIp\":{\"type\":\"BOOL\",\"value\":false}}", "CA10Z1__privateNetworkSubnet__c": "pns-003", "CA10Z1__privateNetworkSubnetId__c": "/subscriptions/resourcegroups/providers/subnets/003-1", "CA10Z1__publicNetworkSubnet__c": "pbns-003", "CA10Z1__publicNetworkSubnetId__c": "/subscriptions/resourcegroups/providers/subnets/003-2", "Id": "003", "CA10Z1__privateNetworkSubnet__r": { "CA10__disappearanceTime__c": null, "CA10__networkSecurityGroup__c": null, "CA10__networkSecurityGroupId__c": null, "Id": null, "CA10__networkSecurityGroup__r": { "Id": null, "CA10__disappearanceTime__c": null } }, "CA10Z1__publicNetworkSubnet__r": { "CA10__disappearanceTime__c": null, "CA10__networkSecurityGroup__c": "pbNSG-003", "CA10__networkSecurityGroupId__c": "/subscriptions/resourcegroups/providers/microsoft.network/networksecuritygroups/003-1-nsg", "Id": "pbns-003", "CA10__networkSecurityGroup__r": { "Id": "pbNSG-003", "CA10__disappearanceTime__c": null } } }, { "expectedResult": { "status": "INCOMPLIANT", "conditionIndex": "499", "conditionText": "isEmptyLookup('CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r')", "runtimeError": null }, "context": { "snapshotTime": "2025-11-19T07:17:23Z" }, "CA10Z1__disappearanceTime__c": null, "CA10Z1__parametersJson__c": "{\"customVirtualNetworkId\":{\"type\":\"STRING\",\"value\":\"/subscriptions/8064/resourceGroups/AZ-Network/providers/Microsoft.Network/virtualNetworks/AZ-prd\"},\"customPublicSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"customPrivateSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"enableNoPublicIp\":{\"type\":\"BOOL\",\"value\":false}}", "CA10Z1__privateNetworkSubnet__c": "pns-004", "CA10Z1__privateNetworkSubnetId__c": "/subscriptions/resourcegroups/providers/subnets/004-1", "CA10Z1__publicNetworkSubnet__c": "pbns-004", "CA10Z1__publicNetworkSubnetId__c": "/subscriptions/resourcegroups/providers/subnets/004-2", "Id": "004", "CA10Z1__privateNetworkSubnet__r": { "CA10__disappearanceTime__c": null, "CA10__networkSecurityGroup__c": "prNSG-004", "CA10__networkSecurityGroupId__c": "/subscriptions/resourcegroups/providers/microsoft.network/networksecuritygroups/004nsg", "Id": "pns-004", "CA10__networkSecurityGroup__r": { "Id": "prNSG-004", "CA10__disappearanceTime__c": null } }, "CA10Z1__publicNetworkSubnet__r": { "CA10__disappearanceTime__c": null, "CA10__networkSecurityGroup__c": null, "CA10__networkSecurityGroupId__c": null, "Id": null, "CA10__networkSecurityGroup__r": { "Id": null, "CA10__disappearanceTime__c": null } } }, { "expectedResult": { "status": "COMPLIANT", "conditionIndex": "500", "conditionText": "otherwise", "runtimeError": null }, "context": { "snapshotTime": "2025-11-19T07:17:23Z" }, "CA10Z1__disappearanceTime__c": null, "CA10Z1__parametersJson__c": "{\"customVirtualNetworkId\":{\"type\":\"STRING\",\"value\":\"/subscriptions/8064/resourceGroups/AZ-Network/providers/Microsoft.Network/virtualNetworks/AZ-prd\"},\"customPublicSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"customPrivateSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"enableNoPublicIp\":{\"type\":\"BOOL\",\"value\":false}}", "CA10Z1__privateNetworkSubnet__c": "pns-005", "CA10Z1__privateNetworkSubnetId__c": "/subscriptions/resourcegroups/providers/subnets/005-1", "CA10Z1__publicNetworkSubnet__c": "pbns-005", "CA10Z1__publicNetworkSubnetId__c": "/subscriptions/resourcegroups/providers/subnets/005-2", "Id": "005", "CA10Z1__privateNetworkSubnet__r": { "CA10__disappearanceTime__c": null, "CA10__networkSecurityGroup__c": "prNSG-005", "CA10__networkSecurityGroupId__c": "/subscriptions/resourcegroups/providers/microsoft.network/networksecuritygroups/005nsg", "Id": "pns-005", "CA10__networkSecurityGroup__r": { "Id": "prNSG-005", "CA10__disappearanceTime__c": null } }, "CA10Z1__publicNetworkSubnet__r": { "CA10__disappearanceTime__c": null, "CA10__networkSecurityGroup__c": "pbNSG-005", "CA10__networkSecurityGroupId__c": "/subscriptions/resourcegroups/providers/microsoft.network/networksecuritygroups/005-1-nsg", "Id": "pbns-005", "CA10__networkSecurityGroup__r": { "Id": "pbNSG-005", "CA10__disappearanceTime__c": null } } } ] - path: /types/CA10Z1__CaAzureDatabricksWorkspace__c/object.extracts.yaml md5Hash: 512495ACDA70E3546508F36E8A6F8AAE content: "---\n# Nullable. The encryption keySource (provider). Possible values\ \ (case-insensitive): Microsoft.Keyvault\nextracts:\n - name: \"CA10Z1__encryptionManagedDisksKeySource__c\"\ \n value: \n FIELD:\n path: \"CA10Z1__encryptionManagedDisksKeySource__c\"\ \n# Text.\n - name: \"CA10Z1__publicNetworkAccess__c\"\n value: \n \ \ FIELD:\n path: \"CA10Z1__publicNetworkAccess__c\"\n - name: \"CA10Z1__parametersJson__c\"\ \n value:\n FIELD:\n path: \"CA10Z1__parametersJson__c\"\n \ \ returnType: BYTES\n - name: \"caJsonFrom__parametersJson__c\"\n value:\n\ \ JSON_FROM:\n arg:\n EXTRACT: \"CA10Z1__parametersJson__c\"\ \n undeterminedIf:\n isInvalid: \"DatabricsWorkspace parameters\ \ JSON is invalid\"\n\n - name: \"caJsonText__parametersJsonCustomVirtualNetworkValue__c\"\ \n value: \n JSON_QUERY_TEXT:\n arg: \n EXTRACT: \"\ caJsonFrom__parametersJson__c\"\n expression: \"customVirtualNetworkId.value\"\ \n undeterminedIf: \n evaluationError: \"The JSON query has\ \ failed.\"\n resultTypeMismatch: \"The JSON query did not return a\ \ boolean.\"\n\n - name: \"caJsonText__parametersJsonEnableNoPublicIpValue__c\"\ \n value: \n JSON_QUERY_BOOLEAN:\n arg: \n EXTRACT:\ \ \"caJsonFrom__parametersJson__c\"\n expression: \"enableNoPublicIp.value\"\ \n undeterminedIf: \n evaluationError: \"The JSON query has\ \ failed.\"\n resultTypeMismatch: \"The JSON query did not return a\ \ boolean.\"\n\n# Nullable. Can't have no access, retrieved via Microsoft.Databricks/workspaces\n\ \ - name: CA10Z1__privateNetworkSubnetId__c\n value: \n FIELD:\n \ \ path: CA10Z1__privateNetworkSubnetId__c \n# Nullable. Can't have no\ \ access, retrieved via Microsoft.Databricks/workspaces \n - name: CA10Z1__publicNetworkSubnetId__c\n\ \ value: \n FIELD:\n path: CA10Z1__publicNetworkSubnetId__c" script: |- CREATE TEMP FUNCTION mock_ExpectedResult() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "Id" : "001", "expectedResult" : { "status" : "DISAPPEARED", "conditionIndex" : "99", "conditionText" : "isDisappeared(CA10Z1__disappearanceTime__c)", "runtimeError" : null } }, { "Id" : "002", "expectedResult" : { "status" : "INCOMPLIANT", "conditionIndex" : "299", "conditionText" : "isEmptyLookup('CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r') && isEmptyLookup('CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r')", "runtimeError" : null } }, { "Id" : "003", "expectedResult" : { "status" : "INCOMPLIANT", "conditionIndex" : "399", "conditionText" : "isEmptyLookup('CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r')", "runtimeError" : null } }, { "Id" : "004", "expectedResult" : { "status" : "INCOMPLIANT", "conditionIndex" : "499", "conditionText" : "isEmptyLookup('CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r')", "runtimeError" : null } }, { "Id" : "005", "expectedResult" : { "status" : "COMPLIANT", "conditionIndex" : "500", "conditionText" : "otherwise", "runtimeError" : null } } ]; """; CREATE TEMP FUNCTION mock_CA10Z1__CaAzureDatabricksWorkspace__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "CA10Z1__disappearanceTime__c" : new Date("2025-11-13T16:22:07Z"), "CA10Z1__parametersJson__c" : null, "CA10Z1__privateNetworkSubnet__c" : "", "CA10Z1__privateNetworkSubnetId__c" : "/subscriptions/resourcegroups/providers/subnets/001-1", "CA10Z1__publicNetworkSubnet__c" : "", "CA10Z1__publicNetworkSubnetId__c" : "/subscriptions/resourcegroups/providers/subnets/001-2", "Id" : "001" }, { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "CA10Z1__parametersJson__c" : "{\"customVirtualNetworkId\":{\"type\":\"STRING\",\"value\":\"/subscriptions/8064/resourceGroups/AZ-Network/providers/Microsoft.Network/virtualNetworks/AZ-prd\"},\"customPublicSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"customPrivateSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"enableNoPublicIp\":{\"type\":\"BOOL\",\"value\":false}}", "CA10Z1__privateNetworkSubnet__c" : "", "CA10Z1__privateNetworkSubnetId__c" : "", "CA10Z1__publicNetworkSubnet__c" : "", "CA10Z1__publicNetworkSubnetId__c" : "", "Id" : "002" }, { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "CA10Z1__parametersJson__c" : "{\"customVirtualNetworkId\":{\"type\":\"STRING\",\"value\":\"/subscriptions/8064/resourceGroups/AZ-Network/providers/Microsoft.Network/virtualNetworks/AZ-prd\"},\"customPublicSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"customPrivateSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"enableNoPublicIp\":{\"type\":\"BOOL\",\"value\":false}}", "CA10Z1__privateNetworkSubnet__c" : "pns-003", "CA10Z1__privateNetworkSubnetId__c" : "/subscriptions/resourcegroups/providers/subnets/003-1", "CA10Z1__publicNetworkSubnet__c" : "pbns-003", "CA10Z1__publicNetworkSubnetId__c" : "/subscriptions/resourcegroups/providers/subnets/003-2", "Id" : "003" }, { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "CA10Z1__parametersJson__c" : "{\"customVirtualNetworkId\":{\"type\":\"STRING\",\"value\":\"/subscriptions/8064/resourceGroups/AZ-Network/providers/Microsoft.Network/virtualNetworks/AZ-prd\"},\"customPublicSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"customPrivateSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"enableNoPublicIp\":{\"type\":\"BOOL\",\"value\":false}}", "CA10Z1__privateNetworkSubnet__c" : "pns-004", "CA10Z1__privateNetworkSubnetId__c" : "/subscriptions/resourcegroups/providers/subnets/004-1", "CA10Z1__publicNetworkSubnet__c" : "pbns-004", "CA10Z1__publicNetworkSubnetId__c" : "/subscriptions/resourcegroups/providers/subnets/004-2", "Id" : "004" }, { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "CA10Z1__parametersJson__c" : "{\"customVirtualNetworkId\":{\"type\":\"STRING\",\"value\":\"/subscriptions/8064/resourceGroups/AZ-Network/providers/Microsoft.Network/virtualNetworks/AZ-prd\"},\"customPublicSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"customPrivateSubnetName\":{\"type\":\"STRING\",\"value\":\"Consumer-SN\"},\"enableNoPublicIp\":{\"type\":\"BOOL\",\"value\":false}}", "CA10Z1__privateNetworkSubnet__c" : "pns-005", "CA10Z1__privateNetworkSubnetId__c" : "/subscriptions/resourcegroups/providers/subnets/005-1", "CA10Z1__publicNetworkSubnet__c" : "pbns-005", "CA10Z1__publicNetworkSubnetId__c" : "/subscriptions/resourcegroups/providers/subnets/005-2", "Id" : "005" } ]; """; CREATE TEMP FUNCTION mock_CA10__CaAzureNetworkSecurityGroup__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "Id" : null }, { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "Id" : "pbNSG-003" }, { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "Id" : "prNSG-004" }, { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "Id" : "prNSG-005" }, { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "Id" : "pbNSG-005" } ]; """; CREATE TEMP FUNCTION mock_CA10__CaAzureNetworkSubnet__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "CA10__networkSecurityGroup__c" : null, "CA10__networkSecurityGroupId__c" : null, "Id" : null }, { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "CA10__networkSecurityGroup__c" : "pbNSG-003", "CA10__networkSecurityGroupId__c" : "/subscriptions/resourcegroups/providers/microsoft.network/networksecuritygroups/003-1-nsg", "Id" : "pbns-003" }, { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "CA10__networkSecurityGroup__c" : "prNSG-004", "CA10__networkSecurityGroupId__c" : "/subscriptions/resourcegroups/providers/microsoft.network/networksecuritygroups/004nsg", "Id" : "pns-004" }, { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "CA10__networkSecurityGroup__c" : "prNSG-005", "CA10__networkSecurityGroupId__c" : "/subscriptions/resourcegroups/providers/microsoft.network/networksecuritygroups/005nsg", "Id" : "pns-005" }, { "context" : { "snapshotTime" : new Date("2025-11-19T07:17:23Z") }, "CA10__networkSecurityGroup__c" : "pbNSG-005", "CA10__networkSecurityGroupId__c" : "/subscriptions/resourcegroups/providers/microsoft.network/networksecuritygroups/005-1-nsg", "Id" : "pbns-005" } ]; """; CREATE TEMP FUNCTION process_CA10Z1__CaAzureDatabricksWorkspace__c( obj STRUCT< CA10Z1__disappearanceTime__c TIMESTAMP, CA10Z1__parametersJson__c STRING, CA10Z1__privateNetworkSubnet__r STRUCT< CA10__networkSecurityGroup__r STRUCT< Id STRING, CA10__disappearanceTime__c TIMESTAMP >, CA10__disappearanceTime__c TIMESTAMP, CA10__networkSecurityGroup__c STRING, CA10__networkSecurityGroupId__c STRING, Id STRING >, CA10Z1__privateNetworkSubnet__c STRING, CA10Z1__privateNetworkSubnetId__c STRING, CA10Z1__publicNetworkSubnet__r STRUCT< CA10__networkSecurityGroup__r STRUCT< Id STRING, CA10__disappearanceTime__c TIMESTAMP >, CA10__disappearanceTime__c TIMESTAMP, CA10__networkSecurityGroup__c STRING, CA10__networkSecurityGroupId__c STRING, Id STRING >, CA10Z1__publicNetworkSubnet__c STRING, CA10Z1__publicNetworkSubnetId__c STRING, Id STRING >, snapshotTime TIMESTAMP ) RETURNS STRUCT DETERMINISTIC LANGUAGE js OPTIONS (library=['gs://compliance-platform-public/jmespath.min.js']) AS r""" var TextLib = new function () { this.normalize = function(arg) { return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase(); }; this.isEmpty = function(arg) { return this.normalize(arg) == ''; }; this.isNotEmpty = function(arg) { return this.normalize(arg) != ''; }; this.equal = function(left, right) { return this.normalize(left) == this.normalize(right); }; this.notEqual = function(left, right) { return this.normalize(left) != this.normalize(right); }; this.startsWith = function(arg, substring) { return this.normalize(arg).startsWith(this.normalize(substring)); }; this.endsWith = function(arg, substring) { return this.normalize(arg).endsWith(this.normalize(substring)); }; this.contains = function(arg, substring) { return this.normalize(arg).includes(this.normalize(substring)); }; this.containsAll = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.every(sub => normalizedArg.includes(this.normalize(sub))); }; this.containsAny = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.some(sub => normalizedArg.includes(this.normalize(sub))); }; }(); var references1 = []; // condition[0], conditionIndex:[0..99] references1.push('Deleted From Azure [CA10Z1__disappearanceTime__c]: ' + obj.CA10Z1__disappearanceTime__c); if (obj.CA10Z1__disappearanceTime__c != null) { return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10Z1__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[1], conditionIndex:[100..199] function jsonQueryChecked4() { var input = extract6.call(extract6); var out; try { out = jmespath.search(input, 'customVirtualNetworkId.value'); if (out != null && typeof out != 'string') { throw new Error("UNDETERMINED condition:102", {cause: {status: 'UNDETERMINED', conditionIndex: 102, conditionText: "extract('caJsonFrom__parametersJson__c').jsonQueryText('customVirtualNetworkId.value').isResultTypeMismatch()", currentStateMessage: "The JSON query did not return a boolean.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}}); } } catch (e) { throw new Error("UNDETERMINED condition:103", {cause: {status: 'UNDETERMINED', conditionIndex: 103, conditionText: "extract('caJsonFrom__parametersJson__c').jsonQueryText('customVirtualNetworkId.value').isEvaluationFailed()", currentStateMessage: "The JSON query has failed.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: e.message}}); } return out; } function jsonChecked7() { var input = extract9.call(extract9); input = TextLib.isEmpty(input) ? null : input; var out; try { out = JSON.parse(input); } catch (e) { throw new Error("UNDETERMINED condition:101", {cause: {status: 'UNDETERMINED', conditionIndex: 101, conditionText: "extract('CA10Z1__parametersJson__c').asJson().isInvalid()", currentStateMessage: "DatabricsWorkspace parameters JSON is invalid", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: e.message}}); } return out; } function extract9() { if (!this.out) { this.out = obj.CA10Z1__parametersJson__c; } return this.out; }; function extract6() { if (!this.out) { this.out = jsonChecked7(); } return this.out; }; function extract3() { if (!this.out) { this.out = jsonQueryChecked4(); } return this.out; }; references1.push('Parameters JSON [obj.CA10Z1__parametersJson__c]: ' + obj.CA10Z1__parametersJson__c); try { if (TextLib.isEmpty(extract3.call(extract3))) { return {status: 'INAPPLICABLE', conditionIndex: 199, conditionText: "extract('caJsonText__parametersJsonCustomVirtualNetworkValue__c').isEmpty()", currentStateMessage: "The Databricks workspace is not deployed in a customer-managed virtual network.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } } catch (err) { if (err.cause && err.cause.status) { return err.cause; } else { throw err; } } // condition[2], conditionIndex:[200..299] if ((TextLib.isEmpty(obj.CA10Z1__privateNetworkSubnetId__c) || TextLib.isEmpty(obj.CA10Z1__privateNetworkSubnet__c) || obj.CA10Z1__privateNetworkSubnet__r.CA10__disappearanceTime__c != null || TextLib.isEmpty(obj.CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroupId__c) || TextLib.isEmpty(obj.CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__c) || obj.CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r.CA10__disappearanceTime__c != null) && (TextLib.isEmpty(obj.CA10Z1__publicNetworkSubnetId__c) || TextLib.isEmpty(obj.CA10Z1__publicNetworkSubnet__c) || obj.CA10Z1__publicNetworkSubnet__r.CA10__disappearanceTime__c != null || TextLib.isEmpty(obj.CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroupId__c) || TextLib.isEmpty(obj.CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__c) || obj.CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r.CA10__disappearanceTime__c != null)) { return {status: 'INCOMPLIANT', conditionIndex: 299, conditionText: "isEmptyLookup('CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r') && isEmptyLookup('CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r')", currentStateMessage: "The Databricks workspace network subnets do not have NSGs assigned.", currentStateReferences: references1.join('\n'), remediation: "Assign NSGs to the subnets.", runtimeError: null}; } // condition[3], conditionIndex:[300..399] if (TextLib.isEmpty(obj.CA10Z1__privateNetworkSubnetId__c) || TextLib.isEmpty(obj.CA10Z1__privateNetworkSubnet__c) || obj.CA10Z1__privateNetworkSubnet__r.CA10__disappearanceTime__c != null || TextLib.isEmpty(obj.CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroupId__c) || TextLib.isEmpty(obj.CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__c) || obj.CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r.CA10__disappearanceTime__c != null) { return {status: 'INCOMPLIANT', conditionIndex: 399, conditionText: "isEmptyLookup('CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r')", currentStateMessage: "The Databricks workspace private subnet does not have an NSG assigned.", currentStateReferences: references1.join('\n'), remediation: "Assign an NSG to the subnet.", runtimeError: null}; } // condition[4], conditionIndex:[400..499] if (TextLib.isEmpty(obj.CA10Z1__publicNetworkSubnetId__c) || TextLib.isEmpty(obj.CA10Z1__publicNetworkSubnet__c) || obj.CA10Z1__publicNetworkSubnet__r.CA10__disappearanceTime__c != null || TextLib.isEmpty(obj.CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroupId__c) || TextLib.isEmpty(obj.CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__c) || obj.CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r.CA10__disappearanceTime__c != null) { return {status: 'INCOMPLIANT', conditionIndex: 499, conditionText: "isEmptyLookup('CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r')", currentStateMessage: "The Databricks workspace public subnet does not have an NSG assigned.", currentStateReferences: references1.join('\n'), remediation: "Assign an NSG to the subnet.", runtimeError: null}; } return {status: 'COMPLIANT', conditionIndex: 500, conditionText: "otherwise", currentStateMessage: "The Databricks workspace is configured with a VNet.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; """; SELECT expectedResult.Id as Id, IF ( IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '') AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1) AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '') AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''), "MATCH", "FAIL" ) as match, expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus, expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex, expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText, expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError FROM UNNEST(mock_ExpectedResult()) expectedResult LEFT JOIN ( SELECT sObject.CA10Z1__disappearanceTime__c AS CA10Z1__disappearanceTime__c, sObject.CA10Z1__parametersJson__c AS CA10Z1__parametersJson__c, STRUCT ( STRUCT ( `CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r`.Id AS Id, `CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r`.CA10__disappearanceTime__c AS CA10__disappearanceTime__c ) AS CA10__networkSecurityGroup__r, `CA10Z1__privateNetworkSubnet__r`.CA10__disappearanceTime__c AS CA10__disappearanceTime__c, `CA10Z1__privateNetworkSubnet__r`.CA10__networkSecurityGroup__c AS CA10__networkSecurityGroup__c, `CA10Z1__privateNetworkSubnet__r`.CA10__networkSecurityGroupId__c AS CA10__networkSecurityGroupId__c, `CA10Z1__privateNetworkSubnet__r`.Id AS Id ) AS CA10Z1__privateNetworkSubnet__r, sObject.CA10Z1__privateNetworkSubnet__c AS CA10Z1__privateNetworkSubnet__c, sObject.CA10Z1__privateNetworkSubnetId__c AS CA10Z1__privateNetworkSubnetId__c, STRUCT ( STRUCT ( `CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r`.Id AS Id, `CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r`.CA10__disappearanceTime__c AS CA10__disappearanceTime__c ) AS CA10__networkSecurityGroup__r, `CA10Z1__publicNetworkSubnet__r`.CA10__disappearanceTime__c AS CA10__disappearanceTime__c, `CA10Z1__publicNetworkSubnet__r`.CA10__networkSecurityGroup__c AS CA10__networkSecurityGroup__c, `CA10Z1__publicNetworkSubnet__r`.CA10__networkSecurityGroupId__c AS CA10__networkSecurityGroupId__c, `CA10Z1__publicNetworkSubnet__r`.Id AS Id ) AS CA10Z1__publicNetworkSubnet__r, sObject.CA10Z1__publicNetworkSubnet__c AS CA10Z1__publicNetworkSubnet__c, sObject.CA10Z1__publicNetworkSubnetId__c AS CA10Z1__publicNetworkSubnetId__c, sObject.Id AS Id, process_CA10Z1__CaAzureDatabricksWorkspace__c( STRUCT( sObject.CA10Z1__disappearanceTime__c AS CA10Z1__disappearanceTime__c, sObject.CA10Z1__parametersJson__c AS CA10Z1__parametersJson__c, STRUCT ( STRUCT ( `CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r`.Id AS Id, `CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r`.CA10__disappearanceTime__c AS CA10__disappearanceTime__c ) AS CA10__networkSecurityGroup__r, `CA10Z1__privateNetworkSubnet__r`.CA10__disappearanceTime__c AS CA10__disappearanceTime__c, `CA10Z1__privateNetworkSubnet__r`.CA10__networkSecurityGroup__c AS CA10__networkSecurityGroup__c, `CA10Z1__privateNetworkSubnet__r`.CA10__networkSecurityGroupId__c AS CA10__networkSecurityGroupId__c, `CA10Z1__privateNetworkSubnet__r`.Id AS Id ) AS CA10Z1__privateNetworkSubnet__r, sObject.CA10Z1__privateNetworkSubnet__c AS CA10Z1__privateNetworkSubnet__c, sObject.CA10Z1__privateNetworkSubnetId__c AS CA10Z1__privateNetworkSubnetId__c, STRUCT ( STRUCT ( `CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r`.Id AS Id, `CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r`.CA10__disappearanceTime__c AS CA10__disappearanceTime__c ) AS CA10__networkSecurityGroup__r, `CA10Z1__publicNetworkSubnet__r`.CA10__disappearanceTime__c AS CA10__disappearanceTime__c, `CA10Z1__publicNetworkSubnet__r`.CA10__networkSecurityGroup__c AS CA10__networkSecurityGroup__c, `CA10Z1__publicNetworkSubnet__r`.CA10__networkSecurityGroupId__c AS CA10__networkSecurityGroupId__c, `CA10Z1__publicNetworkSubnet__r`.Id AS Id ) AS CA10Z1__publicNetworkSubnet__r, sObject.CA10Z1__publicNetworkSubnet__c AS CA10Z1__publicNetworkSubnet__c, sObject.CA10Z1__publicNetworkSubnetId__c AS CA10Z1__publicNetworkSubnetId__c, sObject.Id AS Id ), sObject.context.snapshotTime ) as result FROM UNNEST(mock_CA10Z1__CaAzureDatabricksWorkspace__c()) AS sObject LEFT JOIN UNNEST(mock_CA10__CaAzureNetworkSubnet__c()) AS `CA10Z1__privateNetworkSubnet__r` ON sObject.CA10Z1__privateNetworkSubnet__c = `CA10Z1__privateNetworkSubnet__r`.Id LEFT JOIN UNNEST(mock_CA10__CaAzureNetworkSecurityGroup__c()) AS `CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r` ON `CA10Z1__privateNetworkSubnet__r`.CA10__networkSecurityGroup__c = `CA10Z1__privateNetworkSubnet__r.CA10__networkSecurityGroup__r`.Id LEFT JOIN UNNEST(mock_CA10__CaAzureNetworkSubnet__c()) AS `CA10Z1__publicNetworkSubnet__r` ON sObject.CA10Z1__publicNetworkSubnet__c = `CA10Z1__publicNetworkSubnet__r`.Id LEFT JOIN UNNEST(mock_CA10__CaAzureNetworkSecurityGroup__c()) AS `CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r` ON `CA10Z1__publicNetworkSubnet__r`.CA10__networkSecurityGroup__c = `CA10Z1__publicNetworkSubnet__r.CA10__networkSecurityGroup__r`.Id ) sObject ON sObject.Id = expectedResult.Id;