--- policy: /ce/ca/aws/iam/user-has-more-than-one-active-ssh-public-key logic: /ce/ca/aws/iam/user-has-more-than-one-active-ssh-public-key/prod.logic.yaml executionTime: 2026-06-06T12:03:03.544702435Z generationMs: 51 executionMs: 1022 rows: - id: '001' match: true status: expected: INAPPLICABLE actual: INAPPLICABLE conditionIndex: expected: 199 actual: 199 conditionText: expected: CA10__AWS_IAM_SSH_Public_Keys__r.count(COMPLIANT) == number(0.0) actual: CA10__AWS_IAM_SSH_Public_Keys__r.count(COMPLIANT) == number(0.0) runtimeError: {} - id: '002' match: true status: expected: INAPPLICABLE actual: INAPPLICABLE conditionIndex: expected: 199 actual: 199 conditionText: expected: CA10__AWS_IAM_SSH_Public_Keys__r.count(COMPLIANT) == number(0.0) actual: CA10__AWS_IAM_SSH_Public_Keys__r.count(COMPLIANT) == number(0.0) runtimeError: {} - id: '003' match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 299 actual: 299 conditionText: expected: CA10__AWS_IAM_SSH_Public_Keys__r.count(COMPLIANT) > number(1.0) actual: CA10__AWS_IAM_SSH_Public_Keys__r.count(COMPLIANT) > number(1.0) runtimeError: {} - id: '004' match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 300 actual: 300 conditionText: expected: otherwise actual: otherwise runtimeError: {} - id: '005' match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 300 actual: 300 conditionText: expected: otherwise actual: otherwise runtimeError: {} usedFiles: - path: /ce/ca/aws/iam/user-has-more-than-one-active-ssh-public-key/policy.yaml md5Hash: E4E99D285C3A836A2E99367650F98B20 content: "---\nnames:\n full: AWS IAM User has more than one active SSH public\ \ key\n contextual: User has more than one active SSH public key\ndescription:\ \ >\n Identify IAM users who have multiple active SSH public keys. Users should\ \ generally \n only have one active key to ensure strict credential management\ \ and minimize \n the attack surface for programmatic access.\ntype: COMPLIANCE_POLICY\n\ categories:\n - SECURITY\nframeworkMappings:\n - \"/frameworks/cloudaware/identity-and-access-governance/credential-lifecycle-management\"\ \n - \"/frameworks/aws-well-architected/sec/03/06\"\nsimilarPolicies:\n cloudConformity:\n\ \ - url: https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/unnecessary-ssh-public-keys.html\n\ \ name: Unnecessary SSH Public Keys\n" - path: /ce/ca/aws/iam/user-has-more-than-one-active-ssh-public-key/prod.logic.yaml md5Hash: E5FED43FDAD5F1CE41E89036EAA8A6EA content: | --- inputType: "CA10__CaAwsUser__c" testData: - file: test-data.json conditions: - status: "INAPPLICABLE" currentStateMessage: "The user does not have active SSH public keys." check: IS_EQUAL: left: RELATED_LIST_COUNT: status: "COMPLIANT" relationshipName: "CA10__AWS_IAM_SSH_Public_Keys__r" right: NUMBER: 0.0 - status: "INCOMPLIANT" currentStateMessage: "The user has more than one active SSH public key." remediationMessage: "Deactivate or remove the extra active SSH public keys." check: GREATER_THAN: left: RELATED_LIST_COUNT: status: "COMPLIANT" relationshipName: "CA10__AWS_IAM_SSH_Public_Keys__r" right: NUMBER: 1.0 otherwise: status: "COMPLIANT" currentStateMessage: "This IAM user has only one active SSH public key." relatedLists: - relationshipName: "CA10__AWS_IAM_SSH_Public_Keys__r" importExtracts: - file: /types/CA10__CaAwsIamSshPublicKey__c/object.extracts.yaml conditions: - status: "COMPLIANT" currentStateMessage: "This is an active SSH public key." check: IS_EQUAL: left: EXTRACT: "CA10__status__c" right: TEXT: "Active" otherwise: status: "INCOMPLIANT" currentStateMessage: "This SSH public key is inactive." - path: /ce/ca/aws/iam/user-has-more-than-one-active-ssh-public-key/test-data.json md5Hash: 69DA588430148D3DCA14B6701AB1B9EF content: | [ { "expectedResult": { "status": "INAPPLICABLE", "conditionIndex": "199", "conditionText": "CA10__AWS_IAM_SSH_Public_Keys__r.count(COMPLIANT) == number(0.0)", "runtimeError": null }, "context": { "snapshotTime": "2025-12-09T07:11:01Z" }, "CA10__disappearanceTime__c": null, "Id": "001", "CA10__AWS_IAM_SSH_Public_Keys__r": [] }, { "expectedResult": { "status": "INAPPLICABLE", "conditionIndex": "199", "conditionText": "CA10__AWS_IAM_SSH_Public_Keys__r.count(COMPLIANT) == number(0.0)", "runtimeError": null }, "context": { "snapshotTime": "2025-12-09T07:11:01Z" }, "CA10__disappearanceTime__c": null, "Id": "002", "CA10__AWS_IAM_SSH_Public_Keys__r": [ { "CA10__disappearanceTime__c": null, "CA10__status__c": "Inactive", "Id": "id_002_01", "CA10__user__c": "002" } ] }, { "expectedResult": { "status": "INCOMPLIANT", "conditionIndex": "299", "conditionText": "CA10__AWS_IAM_SSH_Public_Keys__r.count(COMPLIANT) > number(1.0)", "runtimeError": null }, "context": { "snapshotTime": "2025-12-09T07:11:01Z" }, "CA10__disappearanceTime__c": null, "Id": "003", "CA10__AWS_IAM_SSH_Public_Keys__r": [ { "CA10__disappearanceTime__c": null, "CA10__status__c": "Active", "Id": "id_003_01", "CA10__user__c": "003" }, { "CA10__disappearanceTime__c": null, "CA10__status__c": "Active", "Id": "id_003_02", "CA10__user__c": "003" } ] }, { "expectedResult": { "status": "COMPLIANT", "conditionIndex": "300", "conditionText": "otherwise", "runtimeError": null }, "context": { "snapshotTime": "2025-12-09T07:11:01Z" }, "CA10__disappearanceTime__c": null, "Id": "004", "CA10__AWS_IAM_SSH_Public_Keys__r": [ { "CA10__disappearanceTime__c": null, "CA10__status__c": "Active", "Id": "id_004_01", "CA10__user__c": "004" } ] }, { "expectedResult": { "status": "COMPLIANT", "conditionIndex": "300", "conditionText": "otherwise", "runtimeError": null }, "context": { "snapshotTime": "2025-12-09T07:11:01Z" }, "CA10__disappearanceTime__c": null, "Id": "005", "CA10__AWS_IAM_SSH_Public_Keys__r": [ { "CA10__disappearanceTime__c": null, "CA10__status__c": "Active", "Id": "id_005_01", "CA10__user__c": "005" }, { "CA10__disappearanceTime__c": null, "CA10__status__c": "Inactive", "Id": "id_005_02", "CA10__user__c": "005" } ] } ] - path: /types/CA10__CaAwsIamSshPublicKey__c/object.extracts.yaml md5Hash: 484B2472B77AA746367697E1C8DF1B3B content: "---\nextracts:\n# Date/Time\n- name: CA10__uploadDate__c\n value: \n\ \ FIELD:\n path: CA10__uploadDate__c\n# Date/Time\n- name: CA10__status__c\n\ \ value: \n FIELD:\n path: CA10__status__c\n" script: |- CREATE TEMP FUNCTION mock_ExpectedResult() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "Id" : "001", "expectedResult" : { "status" : "INAPPLICABLE", "conditionIndex" : "199", "conditionText" : "CA10__AWS_IAM_SSH_Public_Keys__r.count(COMPLIANT) == number(0.0)", "runtimeError" : null } }, { "Id" : "002", "expectedResult" : { "status" : "INAPPLICABLE", "conditionIndex" : "199", "conditionText" : "CA10__AWS_IAM_SSH_Public_Keys__r.count(COMPLIANT) == number(0.0)", "runtimeError" : null } }, { "Id" : "003", "expectedResult" : { "status" : "INCOMPLIANT", "conditionIndex" : "299", "conditionText" : "CA10__AWS_IAM_SSH_Public_Keys__r.count(COMPLIANT) > number(1.0)", "runtimeError" : null } }, { "Id" : "004", "expectedResult" : { "status" : "COMPLIANT", "conditionIndex" : "300", "conditionText" : "otherwise", "runtimeError" : null } }, { "Id" : "005", "expectedResult" : { "status" : "COMPLIANT", "conditionIndex" : "300", "conditionText" : "otherwise", "runtimeError" : null } } ]; """; CREATE TEMP FUNCTION mock_CA10__CaAwsUser__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "context" : { "snapshotTime" : new Date("2025-12-09T07:11:01Z") }, "Id" : "001" }, { "context" : { "snapshotTime" : new Date("2025-12-09T07:11:01Z") }, "Id" : "002" }, { "context" : { "snapshotTime" : new Date("2025-12-09T07:11:01Z") }, "Id" : "003" }, { "context" : { "snapshotTime" : new Date("2025-12-09T07:11:01Z") }, "Id" : "004" }, { "context" : { "snapshotTime" : new Date("2025-12-09T07:11:01Z") }, "Id" : "005" } ]; """; CREATE TEMP FUNCTION mock_CA10__CaAwsIamSshPublicKey__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "context" : { "snapshotTime" : new Date("2025-12-09T07:11:01Z") }, "CA10__status__c" : "Inactive", "CA10__user__c" : "002", "Id" : "id_002_01" }, { "context" : { "snapshotTime" : new Date("2025-12-09T07:11:01Z") }, "CA10__status__c" : "Active", "CA10__user__c" : "003", "Id" : "id_003_01" }, { "context" : { "snapshotTime" : new Date("2025-12-09T07:11:01Z") }, "CA10__status__c" : "Active", "CA10__user__c" : "003", "Id" : "id_003_02" }, { "context" : { "snapshotTime" : new Date("2025-12-09T07:11:01Z") }, "CA10__status__c" : "Active", "CA10__user__c" : "004", "Id" : "id_004_01" }, { "context" : { "snapshotTime" : new Date("2025-12-09T07:11:01Z") }, "CA10__status__c" : "Active", "CA10__user__c" : "005", "Id" : "id_005_01" }, { "context" : { "snapshotTime" : new Date("2025-12-09T07:11:01Z") }, "CA10__status__c" : "Inactive", "CA10__user__c" : "005", "Id" : "id_005_02" } ]; """; CREATE TEMP FUNCTION process_CA10__CaAwsUser__c( obj STRUCT< CA10__disappearanceTime__c TIMESTAMP, CA10__AWS_IAM_SSH_Public_Keys__r ARRAY >>, Id STRING >, snapshotTime TIMESTAMP ) RETURNS STRUCT DETERMINISTIC LANGUAGE js AS r""" var references1 = []; // condition[0], conditionIndex:[0..99] references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c); if (obj.CA10__disappearanceTime__c != null) { return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } var count_CA10__AWS_IAM_SSH_Public_Keys__r_COMPLIANT2 = 0; if (obj.CA10__AWS_IAM_SSH_Public_Keys__r != null) { for (var i3 = 0; i3 < obj.CA10__AWS_IAM_SSH_Public_Keys__r.length; i3++) { if (typeof(obj.CA10__AWS_IAM_SSH_Public_Keys__r[i3].status) !== 'undefined') { if (obj.CA10__AWS_IAM_SSH_Public_Keys__r[i3].status == 'COMPLIANT') { count_CA10__AWS_IAM_SSH_Public_Keys__r_COMPLIANT2 += obj.CA10__AWS_IAM_SSH_Public_Keys__r[i3].count; } } else { if (obj.CA10__AWS_IAM_SSH_Public_Keys__r[i3].result.status == 'COMPLIANT') { count_CA10__AWS_IAM_SSH_Public_Keys__r_COMPLIANT2 += 1; } } } } // condition[1], conditionIndex:[100..199] references1.push('Related list [CA10__AWS_IAM_SSH_Public_Keys__r] has ' + count_CA10__AWS_IAM_SSH_Public_Keys__r_COMPLIANT2 + ' objects in COMPLIANT status'); if (count_CA10__AWS_IAM_SSH_Public_Keys__r_COMPLIANT2 == 0.0) { return {status: 'INAPPLICABLE', conditionIndex: 199, conditionText: "CA10__AWS_IAM_SSH_Public_Keys__r.count(COMPLIANT) == number(0.0)", currentStateMessage: "The user does not have active SSH public keys.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } var count_CA10__AWS_IAM_SSH_Public_Keys__r_COMPLIANT2 = 0; if (obj.CA10__AWS_IAM_SSH_Public_Keys__r != null) { for (var i5 = 0; i5 < obj.CA10__AWS_IAM_SSH_Public_Keys__r.length; i5++) { if (typeof(obj.CA10__AWS_IAM_SSH_Public_Keys__r[i5].status) !== 'undefined') { if (obj.CA10__AWS_IAM_SSH_Public_Keys__r[i5].status == 'COMPLIANT') { count_CA10__AWS_IAM_SSH_Public_Keys__r_COMPLIANT2 += obj.CA10__AWS_IAM_SSH_Public_Keys__r[i5].count; } } else { if (obj.CA10__AWS_IAM_SSH_Public_Keys__r[i5].result.status == 'COMPLIANT') { count_CA10__AWS_IAM_SSH_Public_Keys__r_COMPLIANT2 += 1; } } } } // condition[2], conditionIndex:[200..299] if (count_CA10__AWS_IAM_SSH_Public_Keys__r_COMPLIANT2 != null && 1.0 != null && count_CA10__AWS_IAM_SSH_Public_Keys__r_COMPLIANT2 > 1.0) { return {status: 'INCOMPLIANT', conditionIndex: 299, conditionText: "CA10__AWS_IAM_SSH_Public_Keys__r.count(COMPLIANT) > number(1.0)", currentStateMessage: "The user has more than one active SSH public key.", currentStateReferences: references1.join('\n'), remediation: "Deactivate or remove the extra active SSH public keys.", runtimeError: null}; } return {status: 'COMPLIANT', conditionIndex: 300, conditionText: "otherwise", currentStateMessage: "This IAM user has only one active SSH public key.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; """; CREATE TEMP FUNCTION process_CA10__AWS_IAM_SSH_Public_Keys__r( obj STRUCT< CA10__disappearanceTime__c TIMESTAMP, CA10__status__c STRING, CA10__user__c STRING, Id STRING >, snapshotTime TIMESTAMP ) RETURNS STRUCT DETERMINISTIC LANGUAGE js AS r""" var TextLib = new function () { this.normalize = function(arg) { return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase(); }; this.isEmpty = function(arg) { return this.normalize(arg) == ''; }; this.isNotEmpty = function(arg) { return this.normalize(arg) != ''; }; this.equal = function(left, right) { return this.normalize(left) == this.normalize(right); }; this.notEqual = function(left, right) { return this.normalize(left) != this.normalize(right); }; this.startsWith = function(arg, substring) { return this.normalize(arg).startsWith(this.normalize(substring)); }; this.endsWith = function(arg, substring) { return this.normalize(arg).endsWith(this.normalize(substring)); }; this.contains = function(arg, substring) { return this.normalize(arg).includes(this.normalize(substring)); }; this.containsAll = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.every(sub => normalizedArg.includes(this.normalize(sub))); }; this.containsAny = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.some(sub => normalizedArg.includes(this.normalize(sub))); }; }(); var references1 = []; // condition[0], conditionIndex:[0..99] references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c); if (obj.CA10__disappearanceTime__c != null) { return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[1], conditionIndex:[100..199] function extract3() { if (!this.out) { this.out = obj.CA10__status__c; } return this.out; }; references1.push('Status [obj.CA10__status__c]: ' + obj.CA10__status__c); if (TextLib.equal(extract3.call(extract3), 'Active')) { return {status: 'COMPLIANT', conditionIndex: 199, conditionText: "extract('CA10__status__c') == 'Active'", currentStateMessage: "This is an active SSH public key.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } return {status: 'INCOMPLIANT', conditionIndex: 200, conditionText: "otherwise", currentStateMessage: "This SSH public key is inactive.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; """; SELECT expectedResult.Id as Id, IF ( IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '') AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1) AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '') AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''), "MATCH", "FAIL" ) as match, expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus, expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex, expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText, expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError FROM UNNEST(mock_ExpectedResult()) expectedResult LEFT JOIN ( SELECT sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c, `CA10__AWS_IAM_SSH_Public_Keys__r`.arr AS CA10__AWS_IAM_SSH_Public_Keys__r, sObject.Id AS Id, process_CA10__CaAwsUser__c( STRUCT( sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c, `CA10__AWS_IAM_SSH_Public_Keys__r`.arr AS CA10__AWS_IAM_SSH_Public_Keys__r, sObject.Id AS Id ), sObject.context.snapshotTime ) as result FROM UNNEST(mock_CA10__CaAwsUser__c()) AS sObject LEFT JOIN ( SELECT sObject.CA10__user__c, ARRAY_AGG( STRUCT( sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c, sObject.CA10__status__c AS CA10__status__c, sObject.CA10__user__c AS CA10__user__c, sObject.Id AS Id, process_CA10__AWS_IAM_SSH_Public_Keys__r( STRUCT( sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c, sObject.CA10__status__c AS CA10__status__c, sObject.CA10__user__c AS CA10__user__c, sObject.Id AS Id ), sObject.context.snapshotTime ) as result ) ) AS arr FROM UNNEST(mock_CA10__CaAwsIamSshPublicKey__c()) AS sObject GROUP BY sObject.CA10__user__c ) AS `CA10__AWS_IAM_SSH_Public_Keys__r` ON sObject.Id = `CA10__AWS_IAM_SSH_Public_Keys__r`.CA10__user__c ) sObject ON sObject.Id = expectedResult.Id;