---
policy: /ce/ca/aws/ecs/task-definition-host-network-root-user
logic: /ce/ca/aws/ecs/task-definition-host-network-root-user/prod.logic.yaml
executionTime: 2025-12-17T01:30:46.345348938Z
generationMs: 87
executionMs: 625
rows:
  - id: test1
    match: true
    status:
      expected: DISAPPEARED
      actual: DISAPPEARED
    conditionIndex:
      expected: 99
      actual: 99
    conditionText:
      expected: isDisappeared(CA10__disappearanceTime__c)
      actual: isDisappeared(CA10__disappearanceTime__c)
    runtimeError: {}
  - id: test2
    match: true
    status:
      expected: INAPPLICABLE
      actual: INAPPLICABLE
    conditionIndex:
      expected: 199
      actual: 199
    conditionText:
      expected: extract('CA10__status__c') != 'ACTIVE'
      actual: extract('CA10__status__c') != 'ACTIVE'
    runtimeError: {}
  - id: test3
    match: true
    status:
      expected: INAPPLICABLE
      actual: INAPPLICABLE
    conditionIndex:
      expected: 299
      actual: 299
    conditionText:
      expected: extract('CA10__networkMode__c') != 'host'
      actual: extract('CA10__networkMode__c') != 'host'
    runtimeError: {}
  - id: test4
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 399
      actual: 399
    conditionText:
      expected: CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)
      actual: CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)
    runtimeError: {}
  - id: test5
    match: true
    status:
      expected: COMPLIANT
      actual: COMPLIANT
    conditionIndex:
      expected: 400
      actual: 400
    conditionText:
      expected: otherwise
      actual: otherwise
    runtimeError: {}
  - id: test6
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 399
      actual: 399
    conditionText:
      expected: CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)
      actual: CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)
    runtimeError: {}
  - id: test7
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 399
      actual: 399
    conditionText:
      expected: CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)
      actual: CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)
    runtimeError: {}
usedFiles:
  - path: /ce/ca/aws/ecs/task-definition-host-network-root-user/policy.yaml
    md5Hash: FCB6C6029EDABFE4BABE0F0CC8DC6913
    content: |
      ---
      names:
        full: "AWS ECS Task Definition with Host Network Mode runs containers as root"
        contextual: "Task Definition with Host Network Mode runs containers as root"
      description: >
        Ensure that ECS Task Definitions configured with Host Network Mode do not run
        containers with root privileges. Using the host network mode gives the container
        full access to the host's network stack, and running as root increases the
        risk of container breakout and host compromise.
      type: "COMPLIANCE_POLICY"
      categories:
        - "SECURITY"
      frameworkMappings:
        - "/frameworks/cloudaware/resource-security/secure-access"
        - "/frameworks/aws-fsbp-v1.0.0/ecs/01"
      similarPolicies:
        awsSecurityHub:
          - name: "[ECS.1] Amazon ECS task definitions should have secure networking modes and user definitions"
            url: "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-1"
  - path: /ce/ca/aws/ecs/task-definition-host-network-root-user/prod.logic.yaml
    md5Hash: DC6E603BD7FD6014A16B45331BD7D6E1
    content: "---\ninputType: \"CA10__CaAwsEcsTaskDefinition__c\"\ntestData:\n  -\
      \ file: \"test-data.json\"\nimportExtracts:\n  - file: \"/types/CA10__CaAwsEcsTaskDefinition__c/object.extracts.yaml\"\
      \n  - file: \"/types/CA10__CaAwsEcsContainerDefinition__c/object.extracts.yaml\"\
      \nconditions:\n  - status: \"INAPPLICABLE\"\n    currentStateMessage: \"The\
      \ Task Definition is not active.\"\n    check:\n      NOT_EQUAL:\n        left:\n\
      \          EXTRACT: \"CA10__status__c\"\n        right:\n          TEXT: \"\
      ACTIVE\"\n  - status: \"INAPPLICABLE\"\n    currentStateMessage: \"The Task\
      \ Definition Network Mode is not set to Host.\"\n    check:\n      NOT_EQUAL:\n\
      \        left:\n          EXTRACT: \"CA10__networkMode__c\"\n        right:\n\
      \          TEXT: \"host\"\n  - status: \"INCOMPLIANT\"\n    currentStateMessage:\
      \ \"The Task Definition uses Host Network Mode and has at least one container\
      \ running as root.\"\n    remediationMessage: \"Update the Task Definition to\
      \ specify a non-root user for all containers.\"\n    check:\n      RELATED_LIST_HAS:\n\
      \        status: \"INCOMPLIANT\"\n        relationshipName: \"CA10__AWS_ECS_Container_Definitions__r\"\
      \notherwise:\n  status: \"COMPLIANT\"\n  currentStateMessage: \"The Task Definition\
      \ uses Host Network Mode but all containers are configured to run as a non-root\
      \ user.\"\nrelatedLists:\n  - relationshipName: \"CA10__AWS_ECS_Container_Definitions__r\"\
      \n    conditions:\n      - status: \"INAPPLICABLE\"\n        currentStateMessage:\
      \ \"The container is given elevated privileges on the host container instance.\"\
      \n        check:\n          EXTRACT: \"CA10__privileged__c\"\n      - status:\
      \ \"INCOMPLIANT\"\n        currentStateMessage: \"The container uses the root\
      \ user.\"\n        check:\n          CONTAINS:\n            arg:\n         \
      \     SET:\n                itemType: TEXT\n                items:\n       \
      \           - \"root\"\n                  - \"0\"\n            search:\n   \
      \           EXTRACT: \"CA10__user__c\"\n      - status: \"INCOMPLIANT\"\n  \
      \      currentStateMessage: \"The container uses the root user.\"\n        check:\n\
      \          IS_EMPTY:\n            arg:\n              EXTRACT: \"CA10__user__c\"\
      \n    otherwise:\n      status: \"COMPLIANT\"\n      currentStateMessage: \"\
      The user is non-root.\" "
  - path: /ce/ca/aws/ecs/task-definition-host-network-root-user/test-data.json
    md5Hash: E5500577715488060E8D406782F01B12
    content: |-
      [
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "isDisappeared(CA10__disappearanceTime__c)",
                  "conditionIndex": 99,
                  "status": "DISAPPEARED"
              },
              "CA10__AWS_ECS_Container_Definitions__r": [],
              "context": {
                  "snapshotTime": "2025-12-11T13:41:05Z"
              },
              "CA10__networkMode__c": "awsvpc",
              "Id": "test1",
              "CA10__disappearanceTime__c": "2025-07-31T04:38:58Z",
              "CA10__status__c": "ACTIVE"
          },
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "extract('CA10__status__c') != 'ACTIVE'",
                  "conditionIndex": 199,
                  "status": "INAPPLICABLE"
              },
              "CA10__AWS_ECS_Container_Definitions__r": [
                  {
                      "CA10__privileged__c": false,
                      "CA10__user__c": "",
                      "Id": "test2_1",
                      "CA10__disappearanceTime__c": null,
                      "CA10__taskDefinition__c": "test2"
                  }
              ],
              "context": {
                  "snapshotTime": "2025-12-11T13:41:05Z"
              },
              "CA10__networkMode__c": "awsvpc",
              "Id": "test2",
              "CA10__disappearanceTime__c": null,
              "CA10__status__c": "INACTIVE"
          },
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "extract('CA10__networkMode__c') != 'host'",
                  "conditionIndex": 299,
                  "status": "INAPPLICABLE"
              },
              "CA10__AWS_ECS_Container_Definitions__r": [
                  {
                      "CA10__privileged__c": false,
                      "CA10__user__c": "",
                      "Id": "test3_1",
                      "CA10__disappearanceTime__c": null,
                      "CA10__taskDefinition__c": "test3"
                  }
              ],
              "context": {
                  "snapshotTime": "2025-12-11T13:41:05Z"
              },
              "CA10__networkMode__c": "awsvpc",
              "Id": "test3",
              "CA10__disappearanceTime__c": null,
              "CA10__status__c": "ACTIVE"
          },
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)",
                  "conditionIndex": 399,
                  "status": "INCOMPLIANT"
              },
              "CA10__AWS_ECS_Container_Definitions__r": [
                  {
                      "CA10__privileged__c": false,
                      "CA10__user__c": null,
                      "Id": "test4_1",
                      "CA10__disappearanceTime__c": null,
                      "CA10__taskDefinition__c": "test4"
                  }
              ],
              "context": {
                  "snapshotTime": "2025-12-11T13:41:05Z"
              },
              "CA10__networkMode__c": "host",
              "Id": "test4",
              "CA10__disappearanceTime__c": null,
              "CA10__status__c": "ACTIVE"
          },
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "otherwise",
                  "conditionIndex": 400,
                  "status": "COMPLIANT"
              },
              "CA10__AWS_ECS_Container_Definitions__r": [
                  {
                      "CA10__privileged__c": true,
                      "CA10__user__c": "100",
                      "Id": "test5_1",
                      "CA10__disappearanceTime__c": null,
                      "CA10__taskDefinition__c": "test5"
                  }
              ],
              "context": {
                  "snapshotTime": "2025-12-11T13:41:05Z"
              },
              "CA10__networkMode__c": "host",
              "Id": "test5",
              "CA10__disappearanceTime__c": null,
              "CA10__status__c": "ACTIVE"
          },
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)",
                  "conditionIndex": 399,
                  "status": "INCOMPLIANT"
              },
              "CA10__AWS_ECS_Container_Definitions__r": [
                  {
                      "CA10__privileged__c": false,
                      "CA10__user__c": "",
                      "Id": "test6_1",
                      "CA10__disappearanceTime__c": null,
                      "CA10__taskDefinition__c": "test6"
                  }
              ],
              "context": {
                  "snapshotTime": "2025-12-11T13:41:05Z"
              },
              "CA10__networkMode__c": "host",
              "Id": "test6",
              "CA10__disappearanceTime__c": null,
              "CA10__status__c": "ACTIVE"
          },
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)",
                  "conditionIndex": 399,
                  "status": "INCOMPLIANT"
              },
              "CA10__AWS_ECS_Container_Definitions__r": [
                  {
                      "CA10__privileged__c": false,
                      "CA10__user__c": "0",
                      "Id": "test7_1",
                      "CA10__disappearanceTime__c": null,
                      "CA10__taskDefinition__c": "test7"
                  }
              ],
              "context": {
                  "snapshotTime": "2025-12-11T13:41:05Z"
              },
              "CA10__networkMode__c": "host",
              "Id": "test7",
              "CA10__disappearanceTime__c": null,
              "CA10__status__c": "ACTIVE"
          }
      ]
  - path: /types/CA10__CaAwsEcsContainerDefinition__c/object.extracts.yaml
    md5Hash: CC5A82BF4FFAB345C4215DD75B708F18
    content: "---\nextracts:\n# Checkbox\n  - name: \"CA10__privileged__c\"\n    value:\n\
      \      FIELD:\n        path: \"CA10__privileged__c\"\n# Nullable. \n  - name:\
      \ \"CA10__user__c\"\n    value:\n      FIELD:\n        path: \"CA10__user__c\"\
      \n# Checkbox\n  - name: \"CA10__readonlyRootFilesystem__c\"\n    value:\n  \
      \    FIELD:\n        path: \"CA10__readonlyRootFilesystem__c\"\n  - name: \"\
      CA10__environment__c\"\n    value:\n      FIELD:\n        returnType: \"BYTES\"\
      \n        path: \"CA10__environment__c\"\n# Values: json-file | syslog | journald\
      \ | gelf | fluentd | awslogs | splunk | awsfirelens\n# Nullable. \n  - name:\
      \ \"CA10__logConfigurationDriver__c\"\n    value:\n      FIELD:\n        path:\
      \ \"CA10__logConfigurationDriver__c\"\n"
  - path: /types/CA10__CaAwsEcsTaskDefinition__c/object.extracts.yaml
    md5Hash: 5F3958CAB2B0FF7CE5C1D38F940B5729
    content: "---\nextracts:\n# Values: bridge | host | awsvpc | none\n# Nullable.\n\
      \  - name: \"CA10__networkMode__c\"\n    value:\n      FIELD:\n        path:\
      \ \"CA10__networkMode__c\"\n# Values: ACTIVE | INACTIVE | DELETE_IN_PROGRESS\n\
      # Not nullable. \n  - name: \"CA10__status__c\"\n    value:\n      FIELD:\n\
      \        path: \"CA10__status__c\"\n        undeterminedIf:\n          noAccessDelegate:\n\
      \            path: \"CA10__status__c\"\n            currentStateMessage: \"\
      Task Definition status cannot be empty. Possible permission issue with ecs:DescribeTaskDefinition\"\
      \n# Values: task | host\n# Nullable.\n  - name: \"CA10__pidMode__c\"\n    value:\n\
      \      FIELD:\n        path: \"CA10__pidMode__c\"\n"
script: |-
  CREATE TEMP FUNCTION mock_ExpectedResult()
  RETURNS ARRAY<STRUCT<
          Id STRING,
          expectedResult STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, runtimeError STRING>
      >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "Id" : "test1",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "isDisappeared(CA10__disappearanceTime__c)",
      "conditionIndex" : 99,
      "status" : "DISAPPEARED"
    }
  }, {
    "Id" : "test2",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "extract('CA10__status__c') != 'ACTIVE'",
      "conditionIndex" : 199,
      "status" : "INAPPLICABLE"
    }
  }, {
    "Id" : "test3",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "extract('CA10__networkMode__c') != 'host'",
      "conditionIndex" : 299,
      "status" : "INAPPLICABLE"
    }
  }, {
    "Id" : "test4",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)",
      "conditionIndex" : 399,
      "status" : "INCOMPLIANT"
    }
  }, {
    "Id" : "test5",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "otherwise",
      "conditionIndex" : 400,
      "status" : "COMPLIANT"
    }
  }, {
    "Id" : "test6",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)",
      "conditionIndex" : 399,
      "status" : "INCOMPLIANT"
    }
  }, {
    "Id" : "test7",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)",
      "conditionIndex" : 399,
      "status" : "INCOMPLIANT"
    }
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaAwsEcsTaskDefinition__c()
  RETURNS ARRAY<STRUCT<
      CA10__disappearanceTime__c TIMESTAMP,
      CA10__status__c STRING,
      CA10__networkMode__c STRING,
      Id STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2025-12-11T13:41:05Z")
    },
    "CA10__disappearanceTime__c" : new Date("2025-07-31T04:38:58Z"),
    "CA10__status__c" : "ACTIVE",
    "CA10__networkMode__c" : "awsvpc",
    "Id" : "test1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-11T13:41:05Z")
    },
    "CA10__status__c" : "INACTIVE",
    "CA10__networkMode__c" : "awsvpc",
    "Id" : "test2"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-11T13:41:05Z")
    },
    "CA10__status__c" : "ACTIVE",
    "CA10__networkMode__c" : "awsvpc",
    "Id" : "test3"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-11T13:41:05Z")
    },
    "CA10__status__c" : "ACTIVE",
    "CA10__networkMode__c" : "host",
    "Id" : "test4"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-11T13:41:05Z")
    },
    "CA10__status__c" : "ACTIVE",
    "CA10__networkMode__c" : "host",
    "Id" : "test5"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-11T13:41:05Z")
    },
    "CA10__status__c" : "ACTIVE",
    "CA10__networkMode__c" : "host",
    "Id" : "test6"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-11T13:41:05Z")
    },
    "CA10__status__c" : "ACTIVE",
    "CA10__networkMode__c" : "host",
    "Id" : "test7"
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaAwsEcsContainerDefinition__c()
  RETURNS ARRAY<STRUCT<
      CA10__disappearanceTime__c TIMESTAMP,
      CA10__privileged__c BOOLEAN,
      CA10__user__c STRING,
      CA10__taskDefinition__c STRING,
      Id STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2025-12-11T13:41:05Z")
    },
    "CA10__privileged__c" : false,
    "CA10__user__c" : "",
    "CA10__taskDefinition__c" : "test2",
    "Id" : "test2_1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-11T13:41:05Z")
    },
    "CA10__privileged__c" : false,
    "CA10__user__c" : "",
    "CA10__taskDefinition__c" : "test3",
    "Id" : "test3_1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-11T13:41:05Z")
    },
    "CA10__privileged__c" : false,
    "CA10__user__c" : null,
    "CA10__taskDefinition__c" : "test4",
    "Id" : "test4_1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-11T13:41:05Z")
    },
    "CA10__privileged__c" : true,
    "CA10__user__c" : "100",
    "CA10__taskDefinition__c" : "test5",
    "Id" : "test5_1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-11T13:41:05Z")
    },
    "CA10__privileged__c" : false,
    "CA10__user__c" : "",
    "CA10__taskDefinition__c" : "test6",
    "Id" : "test6_1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-11T13:41:05Z")
    },
    "CA10__privileged__c" : false,
    "CA10__user__c" : "0",
    "CA10__taskDefinition__c" : "test7",
    "Id" : "test7_1"
  } ];
  """;

  CREATE TEMP FUNCTION process_CA10__CaAwsEcsTaskDefinition__c(
      obj STRUCT<
          CA10__disappearanceTime__c TIMESTAMP,
          CA10__status__c STRING,
          CA10__networkMode__c STRING,
          Id STRING,
          CA10__AWS_ECS_Container_Definitions__r ARRAY<STRUCT<
              CA10__disappearanceTime__c TIMESTAMP,
              CA10__privileged__c BOOLEAN,
              CA10__user__c STRING,
              CA10__taskDefinition__c STRING,
              Id STRING,
              result STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
          >>
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
  var TextLib = new function () {
      this.normalize = function(arg) {
          return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase();
      };
      this.isEmpty = function(arg) {
          return this.normalize(arg) == '';
      };
      this.isNotEmpty = function(arg) {
          return this.normalize(arg) != '';
      };
      this.equal = function(left, right) {
          return this.normalize(left) == this.normalize(right);
      };
      this.notEqual = function(left, right) {
          return this.normalize(left) != this.normalize(right);
      };
      this.startsWith = function(arg, substring) {
          return this.normalize(arg).startsWith(this.normalize(substring));
      };
      this.endsWith = function(arg, substring) {
          return this.normalize(arg).endsWith(this.normalize(substring));
      };
      this.contains = function(arg, substring) {
          return this.normalize(arg).includes(this.normalize(substring));
      };
      this.containsAll = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.every(sub => normalizedArg.includes(this.normalize(sub)));
      };
      this.containsAny = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.some(sub => normalizedArg.includes(this.normalize(sub)));
      };
  }();
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c);
      if (obj.CA10__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[1], conditionIndex:[100..199]
      function fieldChecked4() {
          if (TextLib.isEmpty(obj.CA10__status__c)) {
              throw new Error("UNDETERMINED condition:101", {cause: {status: 'UNDETERMINED', conditionIndex: 101, conditionText: "CA10__status__c.delegatedTo(CA10__status__c).isEmpty()", currentStateMessage: "Task Definition status cannot be empty. Possible permission issue with ecs:DescribeTaskDefinition", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          return obj.CA10__status__c;
      }
      function extract3() { if (!this.out) { this.out = fieldChecked4(); } return this.out; };
      references1.push('Status [obj.CA10__status__c]: ' + obj.CA10__status__c);
      try {
          if (TextLib.notEqual(extract3.call(extract3), 'ACTIVE')) {
              return {status: 'INAPPLICABLE', conditionIndex: 199, conditionText: "extract('CA10__status__c') != 'ACTIVE'", currentStateMessage: "The Task Definition is not active.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
          }
      } catch (err) {
          if (err.cause && err.cause.status) { return err.cause; } else { throw err; }
      }
      // condition[2], conditionIndex:[200..299]
      function extract6() { if (!this.out) { this.out = obj.CA10__networkMode__c; } return this.out; };
      references1.push('Network Mode [obj.CA10__networkMode__c]: ' + obj.CA10__networkMode__c);
      if (TextLib.notEqual(extract6.call(extract6), 'host')) {
          return {status: 'INAPPLICABLE', conditionIndex: 299, conditionText: "extract('CA10__networkMode__c') != 'host'", currentStateMessage: "The Task Definition Network Mode is not set to Host.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      var count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT8 = 0;
      if (obj.CA10__AWS_ECS_Container_Definitions__r != null) {
          for (var i9 = 0; i9 < obj.CA10__AWS_ECS_Container_Definitions__r.length; i9++) {
              if (typeof(obj.CA10__AWS_ECS_Container_Definitions__r[i9].status) !== 'undefined') {
                  if (obj.CA10__AWS_ECS_Container_Definitions__r[i9].status == 'INCOMPLIANT') {
                      count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT8 += obj.CA10__AWS_ECS_Container_Definitions__r[i9].count;
                  }
              } else  {
                  if (obj.CA10__AWS_ECS_Container_Definitions__r[i9].result.status == 'INCOMPLIANT') {
                      count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT8 += 1;
                  }
              }
          }
      }
      // condition[3], conditionIndex:[300..399]
      references1.push('Related list [CA10__AWS_ECS_Container_Definitions__r] ' + (count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT8 > 0 ? 'has' : 'does not have') + ' objects in INCOMPLIANT status');
      if (count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT8 > 0) {
          return {status: 'INCOMPLIANT', conditionIndex: 399, conditionText: "CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)", currentStateMessage: "The Task Definition uses Host Network Mode and has at least one container running as root.", currentStateReferences: references1.join('\n'), remediation: "Update the Task Definition to specify a non-root user for all containers.", runtimeError: null};
      }
      return {status: 'COMPLIANT', conditionIndex: 400, conditionText: "otherwise", currentStateMessage: "The Task Definition uses Host Network Mode but all containers are configured to run as a non-root user.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;

  CREATE TEMP FUNCTION process_CA10__AWS_ECS_Container_Definitions__r(
      obj STRUCT<
          CA10__disappearanceTime__c TIMESTAMP,
          CA10__privileged__c BOOLEAN,
          CA10__user__c STRING,
          CA10__taskDefinition__c STRING,
          Id STRING
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
  var CollectionLib = new function () {
      this.parse = function(arg, separator, skipEmpty, skipDuplicates, sort, normalize) {
          if (arg == null) return [];
          let parts = arg.split(separator);
          return this.fromArray(parts, skipEmpty, skipDuplicates, sort, normalize);
      };
      this.fromArray = function(arr, skipEmpty, skipDuplicates, sort, normalize) {
          if (arr == null) return [];
          let result = [];
          let seen = new Set();
          arr.forEach(el => {
              let normalized = normalize ? TextLib.normalize(el) : BytesLib.normalize(el);
              if (!skipEmpty || (normalize ? TextLib.isNotEmpty(el) : BytesLib.isNotEmpty(el))) {
                  if (!skipDuplicates || !seen.has(normalized)) {
                      if (skipDuplicates) seen.add(normalized);
                      result.push(normalized);
                  }
              }
          });
          if (sort) result.sort();
          return result;
      };
      this.equal = function(left, right) {
          left = left == null ? [] : left;
          right = right == null ? [] : right;
          if (left.length !== right.length) return false;
          for (let i = 0; i < left.length; i++) {
              if (left[i] !== right[i]) return false;
          }
          return true;
      };
      this.notEqual = function(left, right) {
          return !this.equal(left, right);
      };
      this.size = function(collection) {
          return collection == null ? 0 : collection.length;
      };
      this.startsWith = function(collection, search, normalize) {
          if (collection == null || collection.length === 0) return false;
          let normalizedSearch = normalize ? TextLib.normalize(search) : BytesLib.normalize(search);
          return collection[0] === normalizedSearch;
      };
      this.endsWith = function(collection, search, normalize) {
          if (collection == null || collection.length === 0) return false;
          let normalizedSearch = normalize ? TextLib.normalize(search) : BytesLib.normalize(search);
          return collection[collection.length - 1] === normalizedSearch;
      };
      this.contains = function(collection, search, normalize) {
          if (collection == null || collection.length === 0) return false;
          return collection.includes(normalize ? TextLib.normalize(search) : BytesLib.normalize(search));
      };
      this.containsAll = function(collection, searchArray, normalize) {
          if (collection == null || collection.length === 0 || searchArray == null || searchArray.length === 0) return false;
          return searchArray.every(search => collection.includes(normalize ? TextLib.normalize(search) : BytesLib.normalize(search)));
      };
      this.containsAny = function(collection, searchArray, normalize) {
          if (collection == null || collection.length === 0 || searchArray == null || searchArray.length === 0) return false;
          return searchArray.some(search => collection.includes(normalize ? TextLib.normalize(search) : BytesLib.normalize(search)));
      };
  }();
  var TextLib = new function () {
      this.normalize = function(arg) {
          return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase();
      };
      this.isEmpty = function(arg) {
          return this.normalize(arg) == '';
      };
      this.isNotEmpty = function(arg) {
          return this.normalize(arg) != '';
      };
      this.equal = function(left, right) {
          return this.normalize(left) == this.normalize(right);
      };
      this.notEqual = function(left, right) {
          return this.normalize(left) != this.normalize(right);
      };
      this.startsWith = function(arg, substring) {
          return this.normalize(arg).startsWith(this.normalize(substring));
      };
      this.endsWith = function(arg, substring) {
          return this.normalize(arg).endsWith(this.normalize(substring));
      };
      this.contains = function(arg, substring) {
          return this.normalize(arg).includes(this.normalize(substring));
      };
      this.containsAll = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.every(sub => normalizedArg.includes(this.normalize(sub)));
      };
      this.containsAny = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.some(sub => normalizedArg.includes(this.normalize(sub)));
      };
  }();
  var BytesLib = new function () {
      this.normalize = function(arg) {
          return arg == null ? '' : arg;
      };
      this.isEmpty = function(arg) {
          return this.normalize(arg) == '';
      };
      this.isNotEmpty = function(arg) {
          return this.normalize(arg) != '';
      };
      this.equal = function(left, right) {
          return this.normalize(left) == this.normalize(right);
      };
      this.notEqual = function(left, right) {
          return this.normalize(left) != this.normalize(right);
      };
      this.startsWith = function(arg, substring) {
          return this.normalize(arg).startsWith(this.normalize(substring));
      };
      this.endsWith = function(arg, substring) {
          return this.normalize(arg).endsWith(this.normalize(substring));
      };
      this.contains = function(arg, substring) {
          return this.normalize(arg).includes(this.normalize(substring));
      };
      this.containsAll = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.every(sub => normalizedArg.includes(this.normalize(sub)));
      };
      this.containsAny = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.some(sub => normalizedArg.includes(this.normalize(sub)));
      };
  }();
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c);
      if (obj.CA10__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[1], conditionIndex:[100..199]
      function extract3() { if (!this.out) { this.out = obj.CA10__privileged__c; } return this.out; };
      references1.push('Privileged [obj.CA10__privileged__c]: ' + obj.CA10__privileged__c);
      if (extract3.call(extract3)) {
          return {status: 'INAPPLICABLE', conditionIndex: 199, conditionText: "extract('CA10__privileged__c')", currentStateMessage: "The container is given elevated privileges on the host container instance.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[2], conditionIndex:[200..299]
      function extract6() { if (!this.out) { this.out = obj.CA10__user__c; } return this.out; };
      references1.push('User [obj.CA10__user__c]: ' + obj.CA10__user__c);
      if (CollectionLib.contains(CollectionLib.fromArray(['root', '0'], true, true, true, true), extract6.call(extract6), true)) {
          return {status: 'INCOMPLIANT', conditionIndex: 299, conditionText: "setOfText(['root', '0']).contains(extract('CA10__user__c'))", currentStateMessage: "The container uses the root user.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[3], conditionIndex:[300..399]
      function extract9() { if (!this.out) { this.out = obj.CA10__user__c; } return this.out; };
      if (TextLib.isEmpty(extract9.call(extract9))) {
          return {status: 'INCOMPLIANT', conditionIndex: 399, conditionText: "extract('CA10__user__c').isEmpty()", currentStateMessage: "The container uses the root user.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      return {status: 'COMPLIANT', conditionIndex: 400, conditionText: "otherwise", currentStateMessage: "The user is non-root.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;


  SELECT
    expectedResult.Id as Id,
    IF (
      IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '')
      AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1)
      AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '')
      AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''),
      "MATCH",
      "FAIL"
    ) as match,
    expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus,
    expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex,
    expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText,
    expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError
  FROM UNNEST(mock_ExpectedResult()) expectedResult
  LEFT JOIN (
      SELECT
          sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
          sObject.CA10__status__c AS CA10__status__c,
          sObject.CA10__networkMode__c AS CA10__networkMode__c,
          sObject.Id AS Id,
          `CA10__AWS_ECS_Container_Definitions__r`.arr AS CA10__AWS_ECS_Container_Definitions__r,
          process_CA10__CaAwsEcsTaskDefinition__c(
              STRUCT(
                  sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                  sObject.CA10__status__c AS CA10__status__c,
                  sObject.CA10__networkMode__c AS CA10__networkMode__c,
                  sObject.Id AS Id,
                  `CA10__AWS_ECS_Container_Definitions__r`.arr AS CA10__AWS_ECS_Container_Definitions__r
              ),
              sObject.context.snapshotTime
          ) as result
      FROM UNNEST(mock_CA10__CaAwsEcsTaskDefinition__c()) AS sObject
      LEFT JOIN (
          SELECT
              sObject.CA10__taskDefinition__c,
              ARRAY_AGG(
                  STRUCT(
                      sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                      sObject.CA10__privileged__c AS CA10__privileged__c,
                      sObject.CA10__user__c AS CA10__user__c,
                      sObject.CA10__taskDefinition__c AS CA10__taskDefinition__c,
                      sObject.Id AS Id,
                      process_CA10__AWS_ECS_Container_Definitions__r(
                          STRUCT(
                              sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                              sObject.CA10__privileged__c AS CA10__privileged__c,
                              sObject.CA10__user__c AS CA10__user__c,
                              sObject.CA10__taskDefinition__c AS CA10__taskDefinition__c,
                              sObject.Id AS Id
                          ),
                          sObject.context.snapshotTime
                      ) as result
                  )
              ) AS arr
          FROM UNNEST(mock_CA10__CaAwsEcsContainerDefinition__c()) AS sObject
          GROUP BY sObject.CA10__taskDefinition__c
      ) AS `CA10__AWS_ECS_Container_Definitions__r`
          ON sObject.Id = `CA10__AWS_ECS_Container_Definitions__r`.CA10__taskDefinition__c
  ) sObject ON sObject.Id = expectedResult.Id;
