---
policy: /ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet
logic: /ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/prod.logic.yaml
executionTime: 2025-10-31T08:20:26.659712236Z
generationMs: 203
executionMs: 263
rows: []
usedFiles:
  - path: /ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/policy.yaml
    md5Hash: F7C926B7A86887ECDAC8FC8766F6AE1E
    content: |
      ---
      names:
        full: AWS EC2 Instance without a public IP address is in a public subnet
        contextual: Instance without a public IP address is in a public subnet
      description: "Migrate EC2 instances that don't need internet access to a private subnet,\
        \ or remove the direct route to an Internet Gateway within the subnet. EC2 Instances\
        \ without a public IPv4/IPv6 address are unable to connect to the internet thus\
        \ making it a potential misconfiguration that can lead to security breaches, convoluted\
        \ network architecture, and unnecessary management overhead. Consider using a bastion\
        \ host or NAT device to provide internet access to EC2 instances that do not require\
        \ to be public."
      type: COMPLIANCE_POLICY
      categories:
        - SECURITY
        - RELIABILITY
      frameworkMappings:
        - "/frameworks/cloudaware/resource-reliability/system-configuration"
  - path: /ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/prod.logic.yaml
    md5Hash: F6141B11A5AA836D07195B433B69112C
    content: "---\n# Policy identifies EC2 Instances in a public subnet without public\
      \ IP address.\n# If an instance doesn't have a public IP, it can't connect to\
      \ the internet and should be in a private subnet\n# Public subnet is a subnet\
      \ that has a route to Internet Gateway\n\n# There are 2 cases when a subnet\
      \ is public.\n\n# Case A - [EC2 Instance . VPC Subnet -> Route Table Association\
      \ . Route Table -> Route]\n# instance subnet has a CUSTOM Route Table with a\
      \ Route to Internet Gateway.\n# in this case the EC2 Instance VPC Subnet will\
      \ have Route Table Association object that points to Route Table -> Route\n\n\
      # Case B - [EC2 Instance . VPC -> Route Table (-> Route Table Association) ->\
      \ Route]\n# instance subnet has a MAIN Route Table (which is denoted by Main\
      \ field on Route Table Association object, and is created by default in VPCs)\
      \ with a Route to Internet Gateway.\n# in this case the EC2 Instance VPC Subnet\
      \ will NOT have Route Table Association object and we have to find the MAIN\
      \ Route Table before we check the Route\n# after we get to VPC -> Route Table\
      \ related list, we have to take 3 steps\n# 1st step: -> Route Table Association\
      \ CA10__main__c == true to slice off only the main table in 3 step\n# 2nd step:\
      \ -> Route CA10__gatewayId__c starts with \"igw\"\n# 3rd step: finally we mark\
      \ as INCOMPLIANT a Route Table that HAS Route Table Association CA10__main__c\
      \ == true AND Route CA10__gatewayId__c starts with \"igw\" \ninputType: CA10__CaAwsInstance__c\n\
      testData:\n  - file: test-data.json\nimportExtracts:\n  - file: \"/types/CA10__CaAwsInstance__c/object.extracts.yaml\"\
      \nconditions:\n  - status: \"INAPPLICABLE\"\n    currentStateMessage: \"Instance\
      \ does not belong to a subnet\"\n    check:\n      IS_EMPTY_LOOKUP: \"CA10__vpcSubnet__r\"\
      \n  - status: \"INAPPLICABLE\"\n    currentStateMessage: \"Instance has a public\
      \ IP\"\n    check:\n      NOT_EMPTY:\n        arg:\n          EXTRACT: \"CA10__publicIpAddress__c\"\
      \n# Case A: 1. INCOMPLIANT status if EC2 Instance . VPC Subnet -> Route Table\
      \ Association has Route Table with a Route to Internet Gateway\n  - status:\
      \ \"INCOMPLIANT\"\n    currentStateMessage: \"This EC2 Instance is in a public\
      \ subnet.\"\n    remediationMessage: \"Consider removing the public route or\
      \ migrating the instance to a private subnet.\"\n    check:\n    # Case A: 1.1.\n\
      \      RELATED_LIST_HAS: \n        status: \"INCOMPLIANT\"\n        relationshipName:\
      \ \"CA10__vpcSubnet__r.CA10__routeTableAssociations__r\"\n# Case A: 1. COMPLIANT\
      \ status if VPC Subnet -> Route Table Association DOESN'T have Route Table with\
      \ a Route to Internet Gateway\n  - status: \"COMPLIANT\"\n    currentStateMessage:\
      \ \"This EC2 Instance is in a private subnet.\"\n    check:\n    # Case A: 1.1.\n\
      \      RELATED_LIST_HAS:\n        status: \"COMPLIANT\"\n        relationshipName:\
      \ \"CA10__vpcSubnet__r.CA10__routeTableAssociations__r\"\n# Case B: 2. INCOMPLIANT\
      \ status if EC2 Instance . VPC -> MAIN Route Table has a Route to Internet Gateway\n\
      \  - status: \"INCOMPLIANT\"\n    currentStateMessage: \"This EC2 Instance is\
      \ in a public subnet.\"\n    remediationMessage: \"Consider removing the public\
      \ route or migrating the instance to a private subnet.\"\n    check:\n    #\
      \ Case B: 2.1.\n      RELATED_LIST_HAS:\n        status: \"INCOMPLIANT\"\n \
      \       relationshipName: \"CA10__vpc__r.CA10__routeTables__r\"\notherwise:\n\
      \  status: \"COMPLIANT\"\n  currentStateMessage: \"This EC2 Instance is not\
      \ in a private subnet.\"\nrelatedLists:\n  - relationshipName: \"CA10__vpcSubnet__r.CA10__routeTableAssociations__r\"\
      \n    importExtracts:\n      - file: \"/types/CA10__CaAwsRoute__c/object.extracts.yaml\"\
      \n    conditions:\n# Case A: 1.1. INCOMPLIANT status if Route Table -> Route\
      \ has Internet Gateway\n      - status: \"INCOMPLIANT\"\n        currentStateMessage:\
      \ \"This subnet route table has an Internet Gateway route.\"\n        remediationMessage:\
      \ \"Consider removing Internet Gateway routes.\"\n        check:\n        #\
      \ Case A: 1.1.1.\n          RELATED_LIST_HAS:\n            status: \"INCOMPLIANT\"\
      \n            relationshipName: \"CA10__routeTable__r.CA10__routes__r\"\n  \
      \  otherwise:\n      status: \"COMPLIANT\"\n      currentStateMessage: \"This\
      \ subnet is compliant\"\n    relatedLists:\n      - relationshipName: \"CA10__routeTable__r.CA10__routes__r\"\
      \n        conditions:\n# Case A: 1.1.1. INCOMPLIANT status if Route has Internet\
      \ Gateway\n          - status: \"INCOMPLIANT\"\n            currentStateMessage:\
      \ \"This is an Internet Gateway route.\"\n            remediationMessage: \"\
      Consider removing this route.\"\n            check:\n              STARTS_WITH:\n\
      \                arg:\n                  EXTRACT: \"CA10__gatewayId__c\"\n \
      \               search:\n                  TEXT: \"igw\"\n        otherwise:\n\
      \          status: \"COMPLIANT\"\n          currentStateMessage: \"This is not\
      \ an Internet Gateway Route.\"\n  - relationshipName: \"CA10__vpc__r.CA10__routeTables__r\"\
      \n    importExtracts:\n      - file: \"/types/CA10__CaAwsRoute__c/object.extracts.yaml\"\
      \n      - file: \"/types/CA10__CaAwsRouteTableAssociation__c/object.extracts.yaml\"\
      \n    conditions:\n# Case B: 2.1. INCOMPLIANT status if VPC -> Route Table HAS\
      \ Route Table Association CA10__main__c == true AND Route CA10__gatewayId__c\
      \ starts with \"igw\" \n      - status: \"INCOMPLIANT\"\n        currentStateMessage:\
      \ \"This is a Main Route Table with an Internet Gateway route.\"\n        remediationMessage:\
      \ \"Consider removing this route.\"\n        check:\n          AND:\n      \
      \      args:\n            # Case B: 2.1.1.\n              - RELATED_LIST_HAS:\n\
      \                  status: \"COMPLIANT\"\n                  relationshipName:\
      \ \"CA10__routeTableAssociations__r\"\n            # Case B: 2.1.2.\n      \
      \        - RELATED_LIST_HAS:\n                  status: \"INCOMPLIANT\"\n  \
      \                relationshipName: \"CA10__routes__r\"\n    otherwise:\n   \
      \   status: \"INAPPLICABLE\"\n      currentStateMessage: \"Custom Route Tables\
      \ or Main Route Table without Internet Gateway.\"\n    relatedLists:\n     \
      \ - relationshipName: \"CA10__routeTableAssociations__r\"\n        conditions:\n\
      # Case B: 2.1.1. COMPLAINT status if Route Table Association CA10__main__c ==\
      \ true\n          - status: \"COMPLIANT\"\n            currentStateMessage:\
      \ \"This is a Main Route Table.\"\n            check:\n              IS_EQUAL:\n\
      \                left:\n                  EXTRACT: \"CA10__main__c\"\n     \
      \           right:\n                  BOOLEAN: true\n        otherwise:\n  \
      \        status: \"INAPPLICABLE\"\n          currentStateMessage: \"This is\
      \ not a Main Route Table.\"\n      - relationshipName: \"CA10__routes__r\"\n\
      \        conditions:\n# Case B: 2.1.2. INCOMPLIANT status if Route CA10__gatewayId__c\
      \ starts with \"igw\" \n          - status: \"INCOMPLIANT\"\n            currentStateMessage:\
      \ \"This is an Internet Gateway route.\"\n            remediationMessage: \"\
      Consider removing this route.\"\n            check:\n              STARTS_WITH:\n\
      \                arg:\n                  EXTRACT: \"CA10__gatewayId__c\"\n \
      \               search:\n                  TEXT: \"igw\"\n        otherwise:\n\
      \          status: \"COMPLIANT\"\n          currentStateMessage: \"This is not\
      \ an Internet Gateway Route.\"\n"
  - path: /ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/test-data.json
    md5Hash: 15F5977FBF2522B1B6312F6B1AF7DEC5
    content: |-
      [
          {
              "expectedResult": {
                  "status": "DISAPPEARED",
                  "conditionIndex": "99",
                  "conditionText": "isDisappeared(CA10__disappearanceTime__c)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-07-04T20:36:39Z"
              },
              "Id": "test1",
              "CA10__disappearanceTime__c": "2024-06-27T15:46:06Z",
              "CA10__vpcSubnet__c": "",
              "CA10__subnetId__c": "",
              "CA10__publicIpAddress__c": "",
              "CA10__vpc__c": "",
              "CA10__vpcSubnet__r": {
                  "Id": null,
                  "CA10__disappearanceTime__c": null,
                  "CA10__routeTableAssociations__r": []
              },
              "CA10__vpc__r": {
                  "Id": null,
                  "CA10__routeTables__r": []
              }
          },
          {
              "expectedResult": {
                  "status": "INAPPLICABLE",
                  "conditionIndex": "199",
                  "conditionText": "isEmptyLookup('CA10__vpcSubnet__r')",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-07-04T20:36:39Z"
              },
              "Id": "test2",
              "CA10__disappearanceTime__c": null,
              "CA10__vpcSubnet__c": "",
              "CA10__subnetId__c": "",
              "CA10__publicIpAddress__c": "",
              "CA10__vpc__c": "",
              "CA10__vpcSubnet__r": {
                  "Id": null,
                  "CA10__disappearanceTime__c": null,
                  "CA10__routeTableAssociations__r": []
              },
              "CA10__vpc__r": {
                  "Id": null,
                  "CA10__routeTables__r": []
              }
          },
          {
              "expectedResult": {
                  "status": "INAPPLICABLE",
                  "conditionIndex": "299",
                  "conditionText": "extract('CA10__publicIpAddress__c').isNotEmpty()",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-07-04T20:36:39Z"
              },
              "Id": "test3",
              "CA10__disappearanceTime__c": null,
              "CA10__vpcSubnet__c": "vpcSubnet3",
              "CA10__subnetId__c": "subnetId",
              "CA10__publicIpAddress__c": "1.1.1.1.",
              "CA10__vpc__c": "vpc3",
              "CA10__vpcSubnet__r": {
                  "Id": "vpcSubnet3",
                  "CA10__disappearanceTime__c": null,
                  "CA10__routeTableAssociations__r": [
                      {
                          "Id": "test3_1",
                          "CA10__disappearanceTime__c": null,
                          "CA10__subnet__c": "vpcSubnet3",
                          "CA10__routeTable__c": "routeTable3",
                          "CA10__routeTable__r": {
                              "Id": "routeTable3",
                              "CA10__routes__r": [
                                  {
                                      "Id": "test3_1_1",
                                      "CA10__disappearanceTime__c": null,
                                      "CA10__gatewayId__c": "igw-3",
                                      "CA10__routeTable__c": "routeTable3"
                                  }
                              ]
                          }
                      }
                  ]
              },
              "CA10__vpc__r": {
                  "Id": "vpc3",
                  "CA10__routeTables__r": []
              }
          },
          {
              "expectedResult": {
                  "status": "INCOMPLIANT",
                  "conditionIndex": "399",
                  "conditionText": "CA10__vpcSubnet__r.CA10__routeTableAssociations__r.has(INCOMPLIANT)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-07-04T20:36:39Z"
              },
              "Id": "test4",
              "CA10__disappearanceTime__c": null,
              "CA10__vpcSubnet__c": "vpcSubnet4",
              "CA10__subnetId__c": "subnetId",
              "CA10__publicIpAddress__c": "",
              "CA10__vpc__c": "vpc4",
              "CA10__vpcSubnet__r": {
                  "Id": "vpcSubnet4",
                  "CA10__disappearanceTime__c": null,
                  "CA10__routeTableAssociations__r": [
                      {
                          "Id": "test4_1",
                          "CA10__disappearanceTime__c": null,
                          "CA10__subnet__c": "vpcSubnet4",
                          "CA10__routeTable__c": "routeTable4",
                          "CA10__routeTable__r": {
                              "Id": "routeTable4",
                              "CA10__routes__r": [
                                  {
                                      "Id": "test4_1_1",
                                      "CA10__disappearanceTime__c": null,
                                      "CA10__gatewayId__c": "igw-4",
                                      "CA10__routeTable__c": "routeTable4"
                                  }
                              ]
                          }
                      }
                  ]
              },
              "CA10__vpc__r": {
                  "Id": "vpc4",
                  "CA10__routeTables__r": []
              }
          },
          {
              "expectedResult": {
                  "status": "COMPLIANT",
                  "conditionIndex": "499",
                  "conditionText": "CA10__vpcSubnet__r.CA10__routeTableAssociations__r.has(COMPLIANT)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-07-04T20:36:39Z"
              },
              "Id": "test5",
              "CA10__disappearanceTime__c": null,
              "CA10__vpcSubnet__c": "vpcSubnet5",
              "CA10__subnetId__c": "subnetId",
              "CA10__publicIpAddress__c": "",
              "CA10__vpc__c": "vpc5",
              "CA10__vpcSubnet__r": {
                  "Id": "vpcSubnet5",
                  "CA10__disappearanceTime__c": null,
                  "CA10__routeTableAssociations__r": [
                      {
                          "Id": "test5_1",
                          "CA10__disappearanceTime__c": null,
                          "CA10__subnet__c": "vpcSubnet5",
                          "CA10__routeTable__c": "routeTable5",
                          "CA10__routeTable__r": {
                              "Id": "routeTable5",
                              "CA10__routes__r": [
                                  {
                                      "Id": "test5_1_1",
                                      "CA10__disappearanceTime__c": null,
                                      "CA10__gatewayId__c": "gatewayId5",
                                      "CA10__routeTable__c": "routeTable5"
                                  }
                              ]
                          }
                      }
                  ]
              },
              "CA10__vpc__r": {
                  "Id": "vpc5",
                  "CA10__routeTables__r": []
              }
          },
          {
              "expectedResult": {
                  "status": "INCOMPLIANT",
                  "conditionIndex": "599",
                  "conditionText": "CA10__vpc__r.CA10__routeTables__r.has(INCOMPLIANT)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-07-04T20:36:39Z"
              },
              "Id": "test6",
              "CA10__disappearanceTime__c": null,
              "CA10__vpcSubnet__c": "vpcSubnet6",
              "CA10__subnetId__c": "subnetId",
              "CA10__publicIpAddress__c": "",
              "CA10__vpc__c": "vpc6",
              "CA10__vpcSubnet__r": {
                  "Id": "vpcSubnet6",
                  "CA10__disappearanceTime__c": null,
                  "CA10__routeTableAssociations__r": []
              },
              "CA10__vpc__r": {
                  "Id": "vpc6",
                  "CA10__routeTables__r": [
                      {
                          "Id": "routeTable6",
                          "CA10__disappearanceTime__c": null,
                          "CA10__vpc__c": "vpc6",
                          "CA10__routeTableAssociations__r": [
                              {
                                  "Id": "test6_1",
                                  "CA10__disappearanceTime__c": null,
                                  "CA10__main__c": true,
                                  "CA10__routeTable__c": "routeTable6"
                              }
                          ],
                          "CA10__routes__r": [
                              {
                                  "Id": "test6_2",
                                  "CA10__disappearanceTime__c": null,
                                  "CA10__gatewayId__c": "igw-6",
                                  "CA10__routeTable__c": "routeTable6"
                              }
                          ]
                      }
                  ]
              }
          },
          {
              "expectedResult": {
                  "status": "COMPLIANT",
                  "conditionIndex": "600",
                  "conditionText": "otherwise",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-07-04T20:36:39Z"
              },
              "Id": "test7",
              "CA10__disappearanceTime__c": null,
              "CA10__vpcSubnet__c": "vpcSubnet7",
              "CA10__subnetId__c": "subnetId",
              "CA10__publicIpAddress__c": "",
              "CA10__vpc__c": "vpc7",
              "CA10__vpcSubnet__r": {
                  "Id": "vpcSubnet7",
                  "CA10__disappearanceTime__c": null,
                  "CA10__routeTableAssociations__r": []
              },
              "CA10__vpc__r": {
                  "Id": "vpc7",
                  "CA10__routeTables__r": [
                      {
                          "Id": "routeTable7",
                          "CA10__disappearanceTime__c": null,
                          "CA10__vpc__c": "vpc7",
                          "CA10__routeTableAssociations__r": [
                              {
                                  "Id": "test7_1",
                                  "CA10__disappearanceTime__c": null,
                                  "CA10__main__c": true,
                                  "CA10__routeTable__c": "routeTable7"
                              }
                          ],
                          "CA10__routes__r": [
                              {
                                  "Id": "test7_2",
                                  "CA10__disappearanceTime__c": null,
                                  "CA10__gatewayId__c": "",
                                  "CA10__routeTable__c": "routeTable7"
                              }
                          ]
                      }
                  ]
              }
          },
          {
              "expectedResult": {
                  "status": "COMPLIANT",
                  "conditionIndex": "499",
                  "conditionText": "CA10__vpcSubnet__r.CA10__routeTableAssociations__r.has(COMPLIANT)",
                  "runtimeError": null
              },
              "context": {
                  "snapshotTime": "2024-07-04T20:36:39Z"
              },
              "Id": "test8",
              "CA10__disappearanceTime__c": null,
              "CA10__vpcSubnet__c": "vpcSubnet8",
              "CA10__subnetId__c": "subnetId",
              "CA10__publicIpAddress__c": "",
              "CA10__vpc__c": "vpc8",
              "CA10__vpcSubnet__r": {
                  "Id": "vpcSubnet8",
                  "CA10__disappearanceTime__c": null,
                  "CA10__routeTableAssociations__r": [
                      {
                          "Id": "test8_1",
                          "CA10__disappearanceTime__c": null,
                          "CA10__subnet__c": "vpcSubnet8",
                          "CA10__routeTable__c": "routeTable8",
                          "CA10__routeTable__r": {
                              "Id": "routeTable8",
                              "CA10__routes__r": [
                                  {
                                      "Id": "test8_1_1",
                                      "CA10__disappearanceTime__c": "2024-07-04T20:36:39Z",
                                      "CA10__gatewayId__c": "igw-8",
                                      "CA10__routeTable__c": "routeTable8"
                                  }
                              ]
                          }
                      }
                  ]
              },
              "CA10__vpc__r": {
                  "Id": "vpc8",
                  "CA10__routeTables__r": []
              }
          }
      ]
  - path: /types/CA10__CaAwsRouteTableAssociation__c/object.extracts.yaml
    md5Hash: A7C7920B6078DD78806ADA0DC37D345B
    content: "---\nextracts:\n# Checkbox. Can't have no access, retrieved via ec2:DescribeRouteTables\n\
      \  - name: \"CA10__main__c\"\n    value: \n      FIELD:\n        path: \"CA10__main__c\""
  - path: /types/CA10__CaAwsRoute__c/object.extracts.yaml
    md5Hash: E4999A9B58375B79BA8254DDA1FC6534
    content: "---\nextracts:\n# Nullable. Can't have no access, retrieved via ec2:DescribeRouteTables\n\
      \  - name: \"CA10__gatewayId__c\"\n    value: \n      FIELD:\n        path:\
      \ \"CA10__gatewayId__c\"\n# Nullable. Can't have no access, retrieved via ec2:DescribeRouteTables\n\
      \  - name: \"CA10__destinationIpv6CidrBlock__c\"\n    value: \n      FIELD:\n\
      \        path: \"CA10__destinationIpv6CidrBlock__c\"\n# Nullable. Can't have\
      \ no access, retrieved via ec2:DescribeRouteTables\n  - name: \"CA10__destinationCidrBlock__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10__destinationCidrBlock__c\""
  - path: /types/CA10__CaAwsInstance__c/object.extracts.yaml
    md5Hash: BA4E6733C7AF791FAB57658956CE24DF
    content: "---\nextracts:\n# Values pending, applied. Not nullable. Can't have\
      \ no access, retrieved via ec2:DescribeInstances\n  - name: \"CA10__metadataState__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10__metadataState__c\"\n    \
      \    undeterminedIf:\n          isEmpty: \"Corrupted data. EC2 Instances Metadata\
      \ State cannot be empty.\"\n# Values: optional, required. Not nullable. Can't\
      \ have no access, retrieved via ec2:DescribeInstances\n  - name: \"CA10__metadataHttpTokens__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10__metadataHttpTokens__c\"\n\
      \        undeterminedIf:\n          isEmpty: \"Corrupted data. EC2 Instances\
      \ Metadata Http Token cannot be empty.\"\n  - name: CA10__iamInstanceProfileArn__c\n\
      \    value:\n      FIELD: \n        path: CA10__iamInstanceProfileArn__c\n#\
      \ Nullable. Can't have no access, retrieved via ec2:DescribeInstances\n  - name:\
      \ \"CA10__publicIpAddress__c\"\n    value: \n      FIELD:\n        path: \"\
      CA10__publicIpAddress__c\"\n# Values: enabled, disabled. Not nullable. Can't\
      \ have no access, retrieved via ec2:DescribeInstances\n  - name: \"CA10__monitoringState__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10__monitoringState__c\"\n  \
      \      undeterminedIf:\n          isEmpty: \"Corrupted data. EC2 Instances Detailed\
      \ Monitoring State cannot be empty.\"\n# Values: pending | running | shutting-down\
      \ | terminated | stopping | stopped. Not nullable.\n  - name: \"CA10__stateName__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10__stateName__c\"\n        undeterminedIf:\n\
      \          noAccessDelegate:\n            path: \"CA10__stateName__c\"\n   \
      \         currentStateMessage: \"Unable to determine EC2 Instances State Name.\
      \ Possible permission issue with ec2:DescribeInstanceStatus\"\n# Number of Days.\
      \ Nullable. Can't have no access, retrieved via ec2:DescribeInstances\n  - name:\
      \ \"CA10__currentRunningTime__c\"\n    value: \n      FIELD:\n        path:\
      \ \"CA10__currentRunningTime__c\"      \n# Nullable.\n  - name: \"CA10__averageCpuTwoWeeks__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10__averageCpuTwoWeeks__c\" \
      \     \n# Nullable.\n  - name: \"CA10__maxCpuTwoWeeks__c\"\n    value: \n  \
      \    FIELD:\n        path: \"CA10__maxCpuTwoWeeks__c\"      \n# Nullable.\n\
      \  - name: \"CA10__sumTwoWeekNetworkOutMb__c\"\n    value: \n      FIELD:\n\
      \        path: \"CA10__sumTwoWeekNetworkOutMb__c\"      \n# Nullable.\n  - name:\
      \ \"CA10__sumTwoWeekNetworkInMb__c\"\n    value: \n      FIELD:\n        path:\
      \ \"CA10__sumTwoWeekNetworkInMb__c\" \n# Nullable.\n  - name: \"CA10__regionName__c\"\
      \n    value:\n      FIELD:\n        path: \"CA10__regionName__c\"\n# Values:\
      \ paravirtual | hvm. Not nullable. Can't have no access, retrieved via ec2:DescribeInstances\n\
      \  - name: \"CA10__virtualizationType__c\"\n    value: \n      FIELD:\n    \
      \    path: \"CA10__virtualizationType__c\"\n        undeterminedIf:\n      \
      \    isEmpty: \"Corrupted data. EC2 Instances Virtualization Type cannot be\
      \ empty.\"\n"
error: "com.gigware.cloudmine.google.CloudmineGoogleException: com.google.api.client.googleapis.json.GoogleJsonResponseException:\
  \ 400 Bad Request\nPOST https://bigquery.googleapis.com/bigquery/v2/projects/cloudaware-cacanew/queries?prettyPrint=false\n\
  {\n  \"code\" : 400,\n  \"errors\" : [ {\n    \"domain\" : \"global\",\n    \"location\"\
  \ : \"q\",\n    \"locationType\" : \"parameter\",\n    \"message\" : \"Function\
  \ not found: process_CA10__routeTable__r_CA10__routes__r at [973:25]\",\n    \"\
  reason\" : \"invalidQuery\"\n  } ],\n  \"message\" : \"Function not found: process_CA10__routeTable__r_CA10__routes__r\
  \ at [973:25]\",\n  \"status\" : \"INVALID_ARGUMENT\"\n}\n\tat com.gigware.cloudmine.google.GoogleUtils.unwrapSingle(GoogleUtils.java:20)\n\
  \tat com.gigware.goldmine.complianceengine.platform.TestExecutorService.executeTests(TestExecutorService.java:66)\n\
  \tat com.gigware.goldmine.api.external.compliance.ComplianceApi.compliancePoliciesExecuteTests(ComplianceApi.java:251)\n\
  \tat jdk.internal.reflect.GeneratedMethodAccessor256.invoke(Unknown Source)\n\t\
  at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\n\
  \tat java.base/java.lang.reflect.Method.invoke(Method.java:569)\n\tat com.google.api.server.spi.SystemService.invokeServiceMethod(SystemService.java:349)\n\
  \tat com.google.api.server.spi.handlers.EndpointsMethodHandler$RestHandler.handle(EndpointsMethodHandler.java:127)\n\
  \tat com.google.api.server.spi.handlers.EndpointsMethodHandler$RestHandler.handle(EndpointsMethodHandler.java:110)\n\
  \tat com.google.api.server.spi.dispatcher.PathDispatcher.dispatch(PathDispatcher.java:50)\n\
  \tat com.google.api.server.spi.EndpointsServlet.service(EndpointsServlet.java:80)\n\
  \tat jakarta.servlet.http.HttpServlet.service(HttpServlet.java:587)\n\tat com.google.inject.servlet.ServletDefinition.doServiceImpl(ServletDefinition.java:293)\n\
  \tat com.google.inject.servlet.ServletDefinition.doService(ServletDefinition.java:283)\n\
  \tat com.google.inject.servlet.ServletDefinition.service(ServletDefinition.java:184)\n\
  \tat com.google.inject.servlet.ManagedServletPipeline.service(ManagedServletPipeline.java:89)\n\
  \tat com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:85)\n\
  \tat com.gigware.goldmine.war.ErrorHandlerFilter.doFilter(ErrorHandlerFilter.java:30)\n\
  \tat com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)\n\
  \tat com.gigware.goldmine.logging.RequestLogFilter.lambda$doFilter$0(RequestLogFilter.java:45)\n\
  \tat com.gigware.goldmine.logging.RequestLogWrapper.wrap(RequestLogWrapper.java:138)\n\
  \tat com.gigware.goldmine.logging.RequestLogFilter.doFilter(RequestLogFilter.java:41)\n\
  \tat com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)\n\
  \tat com.google.inject.servlet.ManagedFilterPipeline.dispatch(ManagedFilterPipeline.java:121)\n\
  \tat com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:133)\n\tat\
  \ org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:202)\n\tat org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)\n\
  \tat org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:527)\n\
  \tat org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:131)\n\
  \tat org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:578)\n\
  \tat org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122)\n\
  \tat org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:223)\n\
  \tat org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1570)\n\
  \tat org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221)\n\
  \tat org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1381)\n\
  \tat org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:176)\n\
  \tat org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:484)\n\
  \tat org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1543)\n\
  \tat org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:174)\n\
  \tat org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1303)\n\
  \tat org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129)\n\
  \tat org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122)\n\
  \tat org.eclipse.jetty.server.Server.handle(Server.java:563)\n\tat org.eclipse.jetty.server.HttpChannel$RequestDispatchable.dispatch(HttpChannel.java:1598)\n\
  \tat org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:753)\n\tat org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:501)\n\
  \tat org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:282)\n\
  \tat org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:314)\n\
  \tat org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100)\n\tat org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)\n\
  \tat org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:421)\n\
  \tat org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:390)\n\
  \tat org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:277)\n\
  \tat org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:199)\n\
  \tat org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:411)\n\
  \tat org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:969)\n\
  \tat org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1194)\n\
  \tat org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1149)\n\
  \tat java.base/java.lang.Thread.run(Thread.java:840)\nCaused by: com.google.api.client.googleapis.json.GoogleJsonResponseException:\
  \ 400 Bad Request\nPOST https://bigquery.googleapis.com/bigquery/v2/projects/cloudaware-cacanew/queries?prettyPrint=false\n\
  {\n  \"code\" : 400,\n  \"errors\" : [ {\n    \"domain\" : \"global\",\n    \"location\"\
  \ : \"q\",\n    \"locationType\" : \"parameter\",\n    \"message\" : \"Function\
  \ not found: process_CA10__routeTable__r_CA10__routes__r at [973:25]\",\n    \"\
  reason\" : \"invalidQuery\"\n  } ],\n  \"message\" : \"Function not found: process_CA10__routeTable__r_CA10__routes__r\
  \ at [973:25]\",\n  \"status\" : \"INVALID_ARGUMENT\"\n}\n\tat com.google.api.client.googleapis.json.GoogleJsonResponseException.from(GoogleJsonResponseException.java:145)\n\
  \tat com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:118)\n\
  \tat com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:37)\n\
  \tat com.google.api.client.googleapis.services.AbstractGoogleClientRequest$3.interceptResponse(AbstractGoogleClientRequest.java:479)\n\
  \tat com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1111)\n\tat\
  \ com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:565)\n\
  \tat com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:506)\n\
  \tat com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute(AbstractGoogleClientRequest.java:616)\n\
  \tat com.gigware.cloudmine.google.GoogleUtils.unwrapSingle(GoogleUtils.java:18)\n\
  \t... 58 more\n"
