---
policy: /ce/ca/aws/ecs/fargate-service-version
logic: /ce/ca/aws/ecs/fargate-service-version/prod.logic.yaml
executionTime: 2025-12-17T01:30:46.139871538Z
generationMs: 59
executionMs: 559
rows:
  - id: test1
    match: true
    status:
      expected: DISAPPEARED
      actual: DISAPPEARED
    conditionIndex:
      expected: 99
      actual: 99
    conditionText:
      expected: isDisappeared(CA10__disappearanceTime__c)
      actual: isDisappeared(CA10__disappearanceTime__c)
    runtimeError: {}
  - id: test2
    match: true
    status:
      expected: INAPPLICABLE
      actual: INAPPLICABLE
    conditionIndex:
      expected: 299
      actual: 299
    conditionText:
      expected: extract('CA10__launchType__c') != 'FARGATE'
      actual: extract('CA10__launchType__c') != 'FARGATE'
    runtimeError: {}
  - id: test3
    match: true
    status:
      expected: COMPLIANT
      actual: COMPLIANT
    conditionIndex:
      expected: 499
      actual: 499
    conditionText:
      expected: extract('CA10__platformVersion__c') == 'LATEST'
      actual: extract('CA10__platformVersion__c') == 'LATEST'
    runtimeError: {}
  - id: test4
    match: true
    status:
      expected: INAPPLICABLE
      actual: INAPPLICABLE
    conditionIndex:
      expected: 199
      actual: 199
    conditionText:
      expected: extract('CA10__status__c') != 'ACTIVE'
      actual: extract('CA10__status__c') != 'ACTIVE'
    runtimeError: {}
  - id: test5
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 399
      actual: 399
    conditionText:
      expected: extract('CA10__platformVersion__c') == '1.3.0'
      actual: extract('CA10__platformVersion__c') == '1.3.0'
    runtimeError: {}
  - id: test6
    match: true
    status:
      expected: COMPLIANT
      actual: COMPLIANT
    conditionIndex:
      expected: 599
      actual: 599
    conditionText:
      expected: extract('CA10__platformVersion__c') == '1.4.0'
      actual: extract('CA10__platformVersion__c') == '1.4.0'
    runtimeError: {}
usedFiles:
  - path: /ce/ca/aws/ecs/fargate-service-version/policy.yaml
    md5Hash: 05B38C5B997DF6463165EEA2B6DD5B6E
    content: |
      ---
      names:
        full: "AWS ECS Fargate Service platform version is outdated"
        contextual: "Fargate Service platform version is outdated"
      description: >
        Ensure that AWS ECS services running on Fargate are configured to use the
        LATEST platform version. Using the LATEST platform version ensures that
        tasks automatically use the most current, stable runtime environment, which
        includes the newest features and security patches.
      type: "COMPLIANCE_POLICY"
      categories:
        - "RELIABILITY"
      frameworkMappings:
        - "/frameworks/cloudaware/resource-reliability/infrastructure-modernization"
        - "/frameworks/aws-fsbp-v1.0.0/ecs/10"
      similarPolicies:
        awsSecurityHub:
          - name: "[ECS.10] ECS Fargate services should run on the latest Fargate platform version"
            url: "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-10"
  - path: /ce/ca/aws/ecs/fargate-service-version/prod.logic.yaml
    md5Hash: 56D0FEA533F297D7A852FCD018ECC032
    content: |
      ---
      inputType: "CA10__CaAwsEcsService__c"
      testData:
        - file: "test-data.json"
      importExtracts:
        - file: "/types/CA10__CaAwsEcsService__c/object.extracts.yaml"
      conditions:
        - status: "INAPPLICABLE"
          currentStateMessage: "The Service is not active."
          check:
            NOT_EQUAL:
              left:
                EXTRACT: "CA10__status__c"
              right:
                TEXT: "ACTIVE"
        - status: "INAPPLICABLE"
          currentStateMessage: "The ECS Service does not use Fargate launch type."
          check:
            NOT_EQUAL:
              left:
                EXTRACT: "CA10__launchType__c"
              right:
                TEXT: "FARGATE"
        - status: "INCOMPLIANT"
          currentStateMessage: "The ECS Fargate Service is using the outdated platform version 1.3.0."
          remediationMessage: "Update the service to use platform version 1.4.0 or LATEST."
          check:
            IS_EQUAL:
              left:
                EXTRACT: "CA10__platformVersion__c"
              right:
                TEXT: "1.3.0"
        - status: "COMPLIANT"
          currentStateMessage: "The ECS Fargate Service is using a recent platform version."
          check:
            IS_EQUAL:
              left:
                EXTRACT: "CA10__platformVersion__c"
              right:
                TEXT: "LATEST"
        - status: "COMPLIANT"
          currentStateMessage: "The ECS Fargate Service is using a recent platform version."
          check:
            IS_EQUAL:
              left:
                EXTRACT: "CA10__platformVersion__c"
              right:
                TEXT: "1.4.0"
      otherwise:
        status: "COMPLIANT"
        currentStateMessage: "The newer version of the ECS Fargate Service."
  - path: /ce/ca/aws/ecs/fargate-service-version/test-data.json
    md5Hash: 6430AA9EBC4DFDE33282D22465610092
    content: |-
      [
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "isDisappeared(CA10__disappearanceTime__c)",
                  "conditionIndex": 99,
                  "status": "DISAPPEARED"
              },
              "context": {
                  "snapshotTime": "2025-12-12T04:42:59Z"
              },
              "CA10__platformVersion__c": "",
              "Id": "test1",
              "CA10__disappearanceTime__c": "2025-12-05T02:07:04Z",
              "CA10__launchType__c": "EC2",
              "CA10__status__c": "ACTIVE"
          },
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "extract('CA10__launchType__c') != 'FARGATE'",
                  "conditionIndex": 299,
                  "status": "INAPPLICABLE"
              },
              "context": {
                  "snapshotTime": "2025-12-12T04:42:59Z"
              },
              "CA10__platformVersion__c": "LATEST",
              "Id": "test2",
              "CA10__disappearanceTime__c": null,
              "CA10__launchType__c": "",
              "CA10__status__c": "ACTIVE"
          },
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "extract('CA10__platformVersion__c') == 'LATEST'",
                  "conditionIndex": 499,
                  "status": "COMPLIANT"
              },
              "context": {
                  "snapshotTime": "2025-12-12T04:42:59Z"
              },
              "CA10__platformVersion__c": "LATEST",
              "Id": "test3",
              "CA10__disappearanceTime__c": null,
              "CA10__launchType__c": "FARGATE",
              "CA10__status__c": "ACTIVE"
          },
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "extract('CA10__status__c') != 'ACTIVE'",
                  "conditionIndex": 199,
                  "status": "INAPPLICABLE"
              },
              "context": {
                  "snapshotTime": "2025-12-12T04:42:59Z"
              },
              "CA10__platformVersion__c": "LATEST",
              "Id": "test4",
              "CA10__disappearanceTime__c": null,
              "CA10__launchType__c": "EC2",
              "CA10__status__c": "INACTIVE"
          },
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "extract('CA10__platformVersion__c') == '1.3.0'",
                  "conditionIndex": 399,
                  "status": "INCOMPLIANT"
              },
              "context": {
                  "snapshotTime": "2025-12-12T04:42:59Z"
              },
              "CA10__platformVersion__c": "1.3.0",
              "Id": "test5",
              "CA10__disappearanceTime__c": null,
              "CA10__launchType__c": "FARGATE",
              "CA10__status__c": "ACTIVE"
          },
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "extract('CA10__platformVersion__c') == '1.4.0'",
                  "conditionIndex": 599,
                  "status": "COMPLIANT"
              },
              "context": {
                  "snapshotTime": "2025-12-12T04:42:59Z"
              },
              "CA10__platformVersion__c": "1.4.0",
              "Id": "test6",
              "CA10__disappearanceTime__c": null,
              "CA10__launchType__c": "FARGATE",
              "CA10__status__c": "ACTIVE"
          }
      ]
  - path: /types/CA10__CaAwsEcsService__c/object.extracts.yaml
    md5Hash: DE9B8176332CECD4A8C53207B8DA95F0
    content: |
      ---
      extracts:
      # Values: Enabled | Disabled. Not nullable.
        - name: "CA10__assignPublicIp__c"
          value:
            FIELD:
              path: "CA10__assignPublicIp__c"
              undeterminedIf:
                noAccessDelegate:
                  path: "CA10__assignPublicIp__c"
                  currentStateMessage: "Service Assign Public IP config cannot be empty. Possible permission issue with ecs:DescribeServices"
      # Values: ACTIVE | DRAINING | INACTIVE. Not nullable.
        - name: "CA10__status__c"
          value:
            FIELD:
              path: "CA10__status__c"
              undeterminedIf:
                noAccessDelegate:
                  path: "CA10__status__c"
                  currentStateMessage: "Service status cannot be empty. Possible permission issue with ecs:DescribeServices"
      # Values: EC2 | FARGATE | EXTERNAL | MANAGED_INSTANCES
      # Nullable
        - name: "CA10__launchType__c"
          value:
            FIELD:
              path: "CA10__launchType__c"
      # Nullable.
        - name: "CA10__platformVersion__c"
          value:
            FIELD:
              path: "CA10__platformVersion__c"
script: |-
  CREATE TEMP FUNCTION mock_ExpectedResult()
  RETURNS ARRAY<STRUCT<
          Id STRING,
          expectedResult STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, runtimeError STRING>
      >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "Id" : "test1",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "isDisappeared(CA10__disappearanceTime__c)",
      "conditionIndex" : 99,
      "status" : "DISAPPEARED"
    }
  }, {
    "Id" : "test2",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "extract('CA10__launchType__c') != 'FARGATE'",
      "conditionIndex" : 299,
      "status" : "INAPPLICABLE"
    }
  }, {
    "Id" : "test3",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "extract('CA10__platformVersion__c') == 'LATEST'",
      "conditionIndex" : 499,
      "status" : "COMPLIANT"
    }
  }, {
    "Id" : "test4",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "extract('CA10__status__c') != 'ACTIVE'",
      "conditionIndex" : 199,
      "status" : "INAPPLICABLE"
    }
  }, {
    "Id" : "test5",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "extract('CA10__platformVersion__c') == '1.3.0'",
      "conditionIndex" : 399,
      "status" : "INCOMPLIANT"
    }
  }, {
    "Id" : "test6",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "extract('CA10__platformVersion__c') == '1.4.0'",
      "conditionIndex" : 599,
      "status" : "COMPLIANT"
    }
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaAwsEcsService__c()
  RETURNS ARRAY<STRUCT<
      CA10__disappearanceTime__c TIMESTAMP,
      CA10__status__c STRING,
      CA10__launchType__c STRING,
      CA10__platformVersion__c STRING,
      Id STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2025-12-12T04:42:59Z")
    },
    "CA10__disappearanceTime__c" : new Date("2025-12-05T02:07:04Z"),
    "CA10__status__c" : "ACTIVE",
    "CA10__launchType__c" : "EC2",
    "CA10__platformVersion__c" : "",
    "Id" : "test1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-12T04:42:59Z")
    },
    "CA10__status__c" : "ACTIVE",
    "CA10__launchType__c" : "",
    "CA10__platformVersion__c" : "LATEST",
    "Id" : "test2"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-12T04:42:59Z")
    },
    "CA10__status__c" : "ACTIVE",
    "CA10__launchType__c" : "FARGATE",
    "CA10__platformVersion__c" : "LATEST",
    "Id" : "test3"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-12T04:42:59Z")
    },
    "CA10__status__c" : "INACTIVE",
    "CA10__launchType__c" : "EC2",
    "CA10__platformVersion__c" : "LATEST",
    "Id" : "test4"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-12T04:42:59Z")
    },
    "CA10__status__c" : "ACTIVE",
    "CA10__launchType__c" : "FARGATE",
    "CA10__platformVersion__c" : "1.3.0",
    "Id" : "test5"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-12T04:42:59Z")
    },
    "CA10__status__c" : "ACTIVE",
    "CA10__launchType__c" : "FARGATE",
    "CA10__platformVersion__c" : "1.4.0",
    "Id" : "test6"
  } ];
  """;

  CREATE TEMP FUNCTION process_CA10__CaAwsEcsService__c(
      obj STRUCT<
          CA10__disappearanceTime__c TIMESTAMP,
          CA10__status__c STRING,
          CA10__launchType__c STRING,
          CA10__platformVersion__c STRING,
          Id STRING
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
  var TextLib = new function () {
      this.normalize = function(arg) {
          return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase();
      };
      this.isEmpty = function(arg) {
          return this.normalize(arg) == '';
      };
      this.isNotEmpty = function(arg) {
          return this.normalize(arg) != '';
      };
      this.equal = function(left, right) {
          return this.normalize(left) == this.normalize(right);
      };
      this.notEqual = function(left, right) {
          return this.normalize(left) != this.normalize(right);
      };
      this.startsWith = function(arg, substring) {
          return this.normalize(arg).startsWith(this.normalize(substring));
      };
      this.endsWith = function(arg, substring) {
          return this.normalize(arg).endsWith(this.normalize(substring));
      };
      this.contains = function(arg, substring) {
          return this.normalize(arg).includes(this.normalize(substring));
      };
      this.containsAll = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.every(sub => normalizedArg.includes(this.normalize(sub)));
      };
      this.containsAny = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.some(sub => normalizedArg.includes(this.normalize(sub)));
      };
  }();
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c);
      if (obj.CA10__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[1], conditionIndex:[100..199]
      function fieldChecked4() {
          if (TextLib.isEmpty(obj.CA10__status__c)) {
              throw new Error("UNDETERMINED condition:101", {cause: {status: 'UNDETERMINED', conditionIndex: 101, conditionText: "CA10__status__c.delegatedTo(CA10__status__c).isEmpty()", currentStateMessage: "Service status cannot be empty. Possible permission issue with ecs:DescribeServices", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          return obj.CA10__status__c;
      }
      function extract3() { if (!this.out) { this.out = fieldChecked4(); } return this.out; };
      references1.push('Status [obj.CA10__status__c]: ' + obj.CA10__status__c);
      try {
          if (TextLib.notEqual(extract3.call(extract3), 'ACTIVE')) {
              return {status: 'INAPPLICABLE', conditionIndex: 199, conditionText: "extract('CA10__status__c') != 'ACTIVE'", currentStateMessage: "The Service is not active.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
          }
      } catch (err) {
          if (err.cause && err.cause.status) { return err.cause; } else { throw err; }
      }
      // condition[2], conditionIndex:[200..299]
      function extract6() { if (!this.out) { this.out = obj.CA10__launchType__c; } return this.out; };
      references1.push('Launch Type [obj.CA10__launchType__c]: ' + obj.CA10__launchType__c);
      if (TextLib.notEqual(extract6.call(extract6), 'FARGATE')) {
          return {status: 'INAPPLICABLE', conditionIndex: 299, conditionText: "extract('CA10__launchType__c') != 'FARGATE'", currentStateMessage: "The ECS Service does not use Fargate launch type.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[3], conditionIndex:[300..399]
      function extract9() { if (!this.out) { this.out = obj.CA10__platformVersion__c; } return this.out; };
      references1.push('Platform Version [obj.CA10__platformVersion__c]: ' + obj.CA10__platformVersion__c);
      if (TextLib.equal(extract9.call(extract9), '1.3.0')) {
          return {status: 'INCOMPLIANT', conditionIndex: 399, conditionText: "extract('CA10__platformVersion__c') == '1.3.0'", currentStateMessage: "The ECS Fargate Service is using the outdated platform version 1.3.0.", currentStateReferences: references1.join('\n'), remediation: "Update the service to use platform version 1.4.0 or LATEST.", runtimeError: null};
      }
      // condition[4], conditionIndex:[400..499]
      function extract12() { if (!this.out) { this.out = obj.CA10__platformVersion__c; } return this.out; };
      if (TextLib.equal(extract12.call(extract12), 'LATEST')) {
          return {status: 'COMPLIANT', conditionIndex: 499, conditionText: "extract('CA10__platformVersion__c') == 'LATEST'", currentStateMessage: "The ECS Fargate Service is using a recent platform version.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[5], conditionIndex:[500..599]
      function extract15() { if (!this.out) { this.out = obj.CA10__platformVersion__c; } return this.out; };
      if (TextLib.equal(extract15.call(extract15), '1.4.0')) {
          return {status: 'COMPLIANT', conditionIndex: 599, conditionText: "extract('CA10__platformVersion__c') == '1.4.0'", currentStateMessage: "The ECS Fargate Service is using a recent platform version.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      return {status: 'COMPLIANT', conditionIndex: 600, conditionText: "otherwise", currentStateMessage: "The newer version of the ECS Fargate Service.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;


  SELECT
    expectedResult.Id as Id,
    IF (
      IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '')
      AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1)
      AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '')
      AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''),
      "MATCH",
      "FAIL"
    ) as match,
    expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus,
    expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex,
    expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText,
    expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError
  FROM UNNEST(mock_ExpectedResult()) expectedResult
  LEFT JOIN (
      SELECT
          sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
          sObject.CA10__status__c AS CA10__status__c,
          sObject.CA10__launchType__c AS CA10__launchType__c,
          sObject.CA10__platformVersion__c AS CA10__platformVersion__c,
          sObject.Id AS Id,
          process_CA10__CaAwsEcsService__c(
              STRUCT(
                  sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                  sObject.CA10__status__c AS CA10__status__c,
                  sObject.CA10__launchType__c AS CA10__launchType__c,
                  sObject.CA10__platformVersion__c AS CA10__platformVersion__c,
                  sObject.Id AS Id
              ),
              sObject.context.snapshotTime
          ) as result
      FROM UNNEST(mock_CA10__CaAwsEcsService__c()) AS sObject
  ) sObject ON sObject.Id = expectedResult.Id;
