---
policy: /ce/ca/aws/ecs/task-definition-privileged
logic: /ce/ca/aws/ecs/task-definition-privileged/prod.logic.yaml
executionTime: 2025-12-17T01:30:46.769844328Z
generationMs: 64
executionMs: 529
rows:
  - id: test1
    match: true
    status:
      expected: DISAPPEARED
      actual: DISAPPEARED
    conditionIndex:
      expected: 99
      actual: 99
    conditionText:
      expected: isDisappeared(CA10__disappearanceTime__c)
      actual: isDisappeared(CA10__disappearanceTime__c)
    runtimeError: {}
  - id: test2
    match: true
    status:
      expected: INAPPLICABLE
      actual: INAPPLICABLE
    conditionIndex:
      expected: 199
      actual: 199
    conditionText:
      expected: extract('CA10__status__c') != 'ACTIVE'
      actual: extract('CA10__status__c') != 'ACTIVE'
    runtimeError: {}
  - id: test3
    match: true
    status:
      expected: COMPLIANT
      actual: COMPLIANT
    conditionIndex:
      expected: 300
      actual: 300
    conditionText:
      expected: otherwise
      actual: otherwise
    runtimeError: {}
  - id: test4
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 299
      actual: 299
    conditionText:
      expected: CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)
      actual: CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)
    runtimeError: {}
usedFiles:
  - path: /ce/ca/aws/ecs/task-definition-privileged/policy.yaml
    md5Hash: 7AA264739A998D20ED5B6CEDD1635005
    content: |
      ---
      names:
        full: "AWS ECS Task Definition runs as privileged"
        contextual: "Task Definition runs as privileged"
      description: >
        Ensure that AWS ECS Task Definitions do not configure containers to run in
        privileged mode. Privileged containers have access to all devices on the host
        and bypass many of the isolation features of containers, posing a severe security risk.
      type: "COMPLIANCE_POLICY"
      categories:
        - "SECURITY"
      frameworkMappings:
        - "/frameworks/cloudaware/resource-security/secure-access"
        - "/frameworks/aws-fsbp-v1.0.0/ecs/04"
      similarPolicies:
        awsSecurityHub:
          - name: "[ECS.4] ECS containers should run as non-privileged"
            url: "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-4"
  - path: /ce/ca/aws/ecs/task-definition-privileged/prod.logic.yaml
    md5Hash: 88C3EC14039DD4F4165950CD04F4C36B
    content: |-
      ---
      inputType: "CA10__CaAwsEcsTaskDefinition__c"
      testData:
        - file: "test-data.json"
      importExtracts:
        - file: "/types/CA10__CaAwsEcsTaskDefinition__c/object.extracts.yaml"
        - file: "/types/CA10__CaAwsEcsContainerDefinition__c/object.extracts.yaml"
      conditions:
        - status: "INAPPLICABLE"
          currentStateMessage: "The Task Definition is not active."
          check:
            NOT_EQUAL:
              left:
                EXTRACT: "CA10__status__c"
              right:
                TEXT: "ACTIVE"
        - status: "INCOMPLIANT"
          currentStateMessage: "The Task Definition contains at least one container configured to run in privileged mode."
          remediationMessage: "Create a new revision of the Task Definition with 'privileged' set to false for all containers."
          check:
            RELATED_LIST_HAS:
              status: "INCOMPLIANT"
              relationshipName: "CA10__AWS_ECS_Container_Definitions__r"
      otherwise:
        status: "COMPLIANT"
        currentStateMessage: "No containers in the Task Definition are configured to run in privileged mode."
      relatedLists:
        - relationshipName: "CA10__AWS_ECS_Container_Definitions__r"
          conditions:
            - status: "INCOMPLIANT"
              currentStateMessage: "The container is given elevated privileges on the host container instance."
              check:
                EXTRACT: "CA10__privileged__c"
          otherwise:
            status: "COMPLIANT"
            currentStateMessage: "The container does not run in privileged mode."
  - path: /ce/ca/aws/ecs/task-definition-privileged/test-data.json
    md5Hash: DF35EE38E712189DA7C824C840002D17
    content: |-
      [
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "isDisappeared(CA10__disappearanceTime__c)",
                  "conditionIndex": 99,
                  "status": "DISAPPEARED"
              },
              "CA10__AWS_ECS_Container_Definitions__r": [],
              "context": {
                  "snapshotTime": "2025-12-12T04:42:59Z"
              },
              "Id": "test1",
              "CA10__disappearanceTime__c": "2025-07-31T04:38:58Z",
              "CA10__status__c": "ACTIVE"
          },
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "extract('CA10__status__c') != 'ACTIVE'",
                  "conditionIndex": 199,
                  "status": "INAPPLICABLE"
              },
              "CA10__AWS_ECS_Container_Definitions__r": [
                  {
                      "CA10__privileged__c": false,
                      "Id": "test2_1",
                      "CA10__disappearanceTime__c": null,
                      "CA10__taskDefinition__c": "test2"
                  }
              ],
              "context": {
                  "snapshotTime": "2025-12-12T04:42:59Z"
              },
              "Id": "test2",
              "CA10__disappearanceTime__c": null,
              "CA10__status__c": "INACTIVE"
          },
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "otherwise",
                  "conditionIndex": 300,
                  "status": "COMPLIANT"
              },
              "CA10__AWS_ECS_Container_Definitions__r": [
                  {
                      "CA10__privileged__c": false,
                      "Id": "test3_1",
                      "CA10__disappearanceTime__c": null,
                      "CA10__taskDefinition__c": "test3"
                  }
              ],
              "context": {
                  "snapshotTime": "2025-12-12T04:42:59Z"
              },
              "Id": "test3",
              "CA10__disappearanceTime__c": null,
              "CA10__status__c": "ACTIVE"
          },
          {
              "expectedResult": {
                  "runtimeError": null,
                  "conditionText": "CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)",
                  "conditionIndex": 299,
                  "status": "INCOMPLIANT"
              },
              "CA10__AWS_ECS_Container_Definitions__r": [
                  {
                      "CA10__privileged__c": true,
                      "Id": "test4_1",
                      "CA10__disappearanceTime__c": null,
                      "CA10__taskDefinition__c": "test4"
                  }
              ],
              "context": {
                  "snapshotTime": "2025-12-12T04:42:59Z"
              },
              "Id": "test4",
              "CA10__disappearanceTime__c": null,
              "CA10__status__c": "ACTIVE"
          }
      ]
  - path: /types/CA10__CaAwsEcsContainerDefinition__c/object.extracts.yaml
    md5Hash: CC5A82BF4FFAB345C4215DD75B708F18
    content: "---\nextracts:\n# Checkbox\n  - name: \"CA10__privileged__c\"\n    value:\n\
      \      FIELD:\n        path: \"CA10__privileged__c\"\n# Nullable. \n  - name:\
      \ \"CA10__user__c\"\n    value:\n      FIELD:\n        path: \"CA10__user__c\"\
      \n# Checkbox\n  - name: \"CA10__readonlyRootFilesystem__c\"\n    value:\n  \
      \    FIELD:\n        path: \"CA10__readonlyRootFilesystem__c\"\n  - name: \"\
      CA10__environment__c\"\n    value:\n      FIELD:\n        returnType: \"BYTES\"\
      \n        path: \"CA10__environment__c\"\n# Values: json-file | syslog | journald\
      \ | gelf | fluentd | awslogs | splunk | awsfirelens\n# Nullable. \n  - name:\
      \ \"CA10__logConfigurationDriver__c\"\n    value:\n      FIELD:\n        path:\
      \ \"CA10__logConfigurationDriver__c\"\n"
  - path: /types/CA10__CaAwsEcsTaskDefinition__c/object.extracts.yaml
    md5Hash: 5F3958CAB2B0FF7CE5C1D38F940B5729
    content: "---\nextracts:\n# Values: bridge | host | awsvpc | none\n# Nullable.\n\
      \  - name: \"CA10__networkMode__c\"\n    value:\n      FIELD:\n        path:\
      \ \"CA10__networkMode__c\"\n# Values: ACTIVE | INACTIVE | DELETE_IN_PROGRESS\n\
      # Not nullable. \n  - name: \"CA10__status__c\"\n    value:\n      FIELD:\n\
      \        path: \"CA10__status__c\"\n        undeterminedIf:\n          noAccessDelegate:\n\
      \            path: \"CA10__status__c\"\n            currentStateMessage: \"\
      Task Definition status cannot be empty. Possible permission issue with ecs:DescribeTaskDefinition\"\
      \n# Values: task | host\n# Nullable.\n  - name: \"CA10__pidMode__c\"\n    value:\n\
      \      FIELD:\n        path: \"CA10__pidMode__c\"\n"
script: |-
  CREATE TEMP FUNCTION mock_ExpectedResult()
  RETURNS ARRAY<STRUCT<
          Id STRING,
          expectedResult STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, runtimeError STRING>
      >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "Id" : "test1",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "isDisappeared(CA10__disappearanceTime__c)",
      "conditionIndex" : 99,
      "status" : "DISAPPEARED"
    }
  }, {
    "Id" : "test2",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "extract('CA10__status__c') != 'ACTIVE'",
      "conditionIndex" : 199,
      "status" : "INAPPLICABLE"
    }
  }, {
    "Id" : "test3",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "otherwise",
      "conditionIndex" : 300,
      "status" : "COMPLIANT"
    }
  }, {
    "Id" : "test4",
    "expectedResult" : {
      "runtimeError" : null,
      "conditionText" : "CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)",
      "conditionIndex" : 299,
      "status" : "INCOMPLIANT"
    }
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaAwsEcsTaskDefinition__c()
  RETURNS ARRAY<STRUCT<
      CA10__disappearanceTime__c TIMESTAMP,
      CA10__status__c STRING,
      Id STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2025-12-12T04:42:59Z")
    },
    "CA10__disappearanceTime__c" : new Date("2025-07-31T04:38:58Z"),
    "CA10__status__c" : "ACTIVE",
    "Id" : "test1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-12T04:42:59Z")
    },
    "CA10__status__c" : "INACTIVE",
    "Id" : "test2"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-12T04:42:59Z")
    },
    "CA10__status__c" : "ACTIVE",
    "Id" : "test3"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-12T04:42:59Z")
    },
    "CA10__status__c" : "ACTIVE",
    "Id" : "test4"
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaAwsEcsContainerDefinition__c()
  RETURNS ARRAY<STRUCT<
      CA10__disappearanceTime__c TIMESTAMP,
      CA10__privileged__c BOOLEAN,
      CA10__taskDefinition__c STRING,
      Id STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2025-12-12T04:42:59Z")
    },
    "CA10__privileged__c" : false,
    "CA10__taskDefinition__c" : "test2",
    "Id" : "test2_1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-12T04:42:59Z")
    },
    "CA10__privileged__c" : false,
    "CA10__taskDefinition__c" : "test3",
    "Id" : "test3_1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-12-12T04:42:59Z")
    },
    "CA10__privileged__c" : true,
    "CA10__taskDefinition__c" : "test4",
    "Id" : "test4_1"
  } ];
  """;

  CREATE TEMP FUNCTION process_CA10__CaAwsEcsTaskDefinition__c(
      obj STRUCT<
          CA10__disappearanceTime__c TIMESTAMP,
          CA10__status__c STRING,
          Id STRING,
          CA10__AWS_ECS_Container_Definitions__r ARRAY<STRUCT<
              CA10__disappearanceTime__c TIMESTAMP,
              CA10__privileged__c BOOLEAN,
              CA10__taskDefinition__c STRING,
              Id STRING,
              result STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
          >>
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
  var TextLib = new function () {
      this.normalize = function(arg) {
          return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase();
      };
      this.isEmpty = function(arg) {
          return this.normalize(arg) == '';
      };
      this.isNotEmpty = function(arg) {
          return this.normalize(arg) != '';
      };
      this.equal = function(left, right) {
          return this.normalize(left) == this.normalize(right);
      };
      this.notEqual = function(left, right) {
          return this.normalize(left) != this.normalize(right);
      };
      this.startsWith = function(arg, substring) {
          return this.normalize(arg).startsWith(this.normalize(substring));
      };
      this.endsWith = function(arg, substring) {
          return this.normalize(arg).endsWith(this.normalize(substring));
      };
      this.contains = function(arg, substring) {
          return this.normalize(arg).includes(this.normalize(substring));
      };
      this.containsAll = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.every(sub => normalizedArg.includes(this.normalize(sub)));
      };
      this.containsAny = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.some(sub => normalizedArg.includes(this.normalize(sub)));
      };
  }();
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c);
      if (obj.CA10__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[1], conditionIndex:[100..199]
      function fieldChecked4() {
          if (TextLib.isEmpty(obj.CA10__status__c)) {
              throw new Error("UNDETERMINED condition:101", {cause: {status: 'UNDETERMINED', conditionIndex: 101, conditionText: "CA10__status__c.delegatedTo(CA10__status__c).isEmpty()", currentStateMessage: "Task Definition status cannot be empty. Possible permission issue with ecs:DescribeTaskDefinition", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          return obj.CA10__status__c;
      }
      function extract3() { if (!this.out) { this.out = fieldChecked4(); } return this.out; };
      references1.push('Status [obj.CA10__status__c]: ' + obj.CA10__status__c);
      try {
          if (TextLib.notEqual(extract3.call(extract3), 'ACTIVE')) {
              return {status: 'INAPPLICABLE', conditionIndex: 199, conditionText: "extract('CA10__status__c') != 'ACTIVE'", currentStateMessage: "The Task Definition is not active.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
          }
      } catch (err) {
          if (err.cause && err.cause.status) { return err.cause; } else { throw err; }
      }
      var count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT5 = 0;
      if (obj.CA10__AWS_ECS_Container_Definitions__r != null) {
          for (var i6 = 0; i6 < obj.CA10__AWS_ECS_Container_Definitions__r.length; i6++) {
              if (typeof(obj.CA10__AWS_ECS_Container_Definitions__r[i6].status) !== 'undefined') {
                  if (obj.CA10__AWS_ECS_Container_Definitions__r[i6].status == 'INCOMPLIANT') {
                      count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT5 += obj.CA10__AWS_ECS_Container_Definitions__r[i6].count;
                  }
              } else  {
                  if (obj.CA10__AWS_ECS_Container_Definitions__r[i6].result.status == 'INCOMPLIANT') {
                      count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT5 += 1;
                  }
              }
          }
      }
      // condition[2], conditionIndex:[200..299]
      references1.push('Related list [CA10__AWS_ECS_Container_Definitions__r] ' + (count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT5 > 0 ? 'has' : 'does not have') + ' objects in INCOMPLIANT status');
      if (count_CA10__AWS_ECS_Container_Definitions__r_INCOMPLIANT5 > 0) {
          return {status: 'INCOMPLIANT', conditionIndex: 299, conditionText: "CA10__AWS_ECS_Container_Definitions__r.has(INCOMPLIANT)", currentStateMessage: "The Task Definition contains at least one container configured to run in privileged mode.", currentStateReferences: references1.join('\n'), remediation: "Create a new revision of the Task Definition with 'privileged' set to false for all containers.", runtimeError: null};
      }
      return {status: 'COMPLIANT', conditionIndex: 300, conditionText: "otherwise", currentStateMessage: "No containers in the Task Definition are configured to run in privileged mode.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;

  CREATE TEMP FUNCTION process_CA10__AWS_ECS_Container_Definitions__r(
      obj STRUCT<
          CA10__disappearanceTime__c TIMESTAMP,
          CA10__privileged__c BOOLEAN,
          CA10__taskDefinition__c STRING,
          Id STRING
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From AWS [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c);
      if (obj.CA10__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[1], conditionIndex:[100..199]
      function extract3() { if (!this.out) { this.out = obj.CA10__privileged__c; } return this.out; };
      references1.push('Privileged [obj.CA10__privileged__c]: ' + obj.CA10__privileged__c);
      if (extract3.call(extract3)) {
          return {status: 'INCOMPLIANT', conditionIndex: 199, conditionText: "extract('CA10__privileged__c')", currentStateMessage: "The container is given elevated privileges on the host container instance.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      return {status: 'COMPLIANT', conditionIndex: 200, conditionText: "otherwise", currentStateMessage: "The container does not run in privileged mode.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;


  SELECT
    expectedResult.Id as Id,
    IF (
      IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '')
      AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1)
      AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '')
      AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''),
      "MATCH",
      "FAIL"
    ) as match,
    expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus,
    expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex,
    expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText,
    expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError
  FROM UNNEST(mock_ExpectedResult()) expectedResult
  LEFT JOIN (
      SELECT
          sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
          sObject.CA10__status__c AS CA10__status__c,
          sObject.Id AS Id,
          `CA10__AWS_ECS_Container_Definitions__r`.arr AS CA10__AWS_ECS_Container_Definitions__r,
          process_CA10__CaAwsEcsTaskDefinition__c(
              STRUCT(
                  sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                  sObject.CA10__status__c AS CA10__status__c,
                  sObject.Id AS Id,
                  `CA10__AWS_ECS_Container_Definitions__r`.arr AS CA10__AWS_ECS_Container_Definitions__r
              ),
              sObject.context.snapshotTime
          ) as result
      FROM UNNEST(mock_CA10__CaAwsEcsTaskDefinition__c()) AS sObject
      LEFT JOIN (
          SELECT
              sObject.CA10__taskDefinition__c,
              ARRAY_AGG(
                  STRUCT(
                      sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                      sObject.CA10__privileged__c AS CA10__privileged__c,
                      sObject.CA10__taskDefinition__c AS CA10__taskDefinition__c,
                      sObject.Id AS Id,
                      process_CA10__AWS_ECS_Container_Definitions__r(
                          STRUCT(
                              sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                              sObject.CA10__privileged__c AS CA10__privileged__c,
                              sObject.CA10__taskDefinition__c AS CA10__taskDefinition__c,
                              sObject.Id AS Id
                          ),
                          sObject.context.snapshotTime
                      ) as result
                  )
              ) AS arr
          FROM UNNEST(mock_CA10__CaAwsEcsContainerDefinition__c()) AS sObject
          GROUP BY sObject.CA10__taskDefinition__c
      ) AS `CA10__AWS_ECS_Container_Definitions__r`
          ON sObject.Id = `CA10__AWS_ECS_Container_Definitions__r`.CA10__taskDefinition__c
  ) sObject ON sObject.Id = expectedResult.Id;
