--- policy: /ce/ca/oracle/iam/domain-password-policy-weak-complexity logic: /ce/ca/oracle/iam/domain-password-policy-weak-complexity/prod.logic.yaml executionTime: 2026-09-22T15:07:57.780433283Z generationMs: 51 executionMs: 988 rows: - id: test1 match: true status: expected: INAPPLICABLE actual: INAPPLICABLE conditionIndex: expected: 199 actual: 199 conditionText: expected: extract('CA10O1__name__c') == 'defaultPasswordPolicy' actual: extract('CA10O1__name__c') == 'defaultPasswordPolicy' runtimeError: {} - id: test2 match: true status: expected: INAPPLICABLE actual: INAPPLICABLE conditionIndex: expected: 199 actual: 199 conditionText: expected: extract('CA10O1__name__c') == 'defaultPasswordPolicy' actual: extract('CA10O1__name__c') == 'defaultPasswordPolicy' runtimeError: {} - id: test3 match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 399 actual: 399 conditionText: expected: extract('CA10O1__name__c') == 'simplePasswordPolicy' actual: extract('CA10O1__name__c') == 'simplePasswordPolicy' runtimeError: {} - id: test4 match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 499 actual: 499 conditionText: expected: extract('CA10O1__name__c') == 'standardPasswordPolicy' actual: extract('CA10O1__name__c') == 'standardPasswordPolicy' runtimeError: {} - id: test5 match: true status: expected: INAPPLICABLE actual: INAPPLICABLE conditionIndex: expected: 299 actual: 299 conditionText: expected: CA10O1__Oracle_IAM_Groups__r.hasNo(COMPLIANT) actual: CA10O1__Oracle_IAM_Groups__r.hasNo(COMPLIANT) runtimeError: {} - id: test6 match: true status: expected: INAPPLICABLE actual: INAPPLICABLE conditionIndex: expected: 299 actual: 299 conditionText: expected: CA10O1__Oracle_IAM_Groups__r.hasNo(COMPLIANT) actual: CA10O1__Oracle_IAM_Groups__r.hasNo(COMPLIANT) runtimeError: {} - id: test7 match: true status: expected: INAPPLICABLE actual: INAPPLICABLE conditionIndex: expected: 199 actual: 199 conditionText: expected: extract('CA10O1__name__c') == 'defaultPasswordPolicy' actual: extract('CA10O1__name__c') == 'defaultPasswordPolicy' runtimeError: {} - id: test8 match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 699 actual: 699 conditionText: expected: extract('CA10O1__minNumerals__c').isEmpty() || extract('CA10O1__minNumerals__c') < number(1.0) actual: extract('CA10O1__minNumerals__c').isEmpty() || extract('CA10O1__minNumerals__c') < number(1.0) runtimeError: {} - id: test9 match: true status: expected: INAPPLICABLE actual: INAPPLICABLE conditionIndex: expected: 299 actual: 299 conditionText: expected: CA10O1__Oracle_IAM_Groups__r.hasNo(COMPLIANT) actual: CA10O1__Oracle_IAM_Groups__r.hasNo(COMPLIANT) runtimeError: {} - id: test10 match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 599 actual: 599 conditionText: expected: extract('CA10O1__passwordLengthMinimum__c').isEmpty() || extract('CA10O1__passwordLengthMinimum__c') < number(14.0) actual: extract('CA10O1__passwordLengthMinimum__c').isEmpty() || extract('CA10O1__passwordLengthMinimum__c') < number(14.0) runtimeError: {} - id: test11 match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 799 actual: 799 conditionText: expected: extract('CA10O1__minSpecialCharacters__c').isEmpty() || extract('CA10O1__minSpecialCharacters__c') < number(1.0) actual: extract('CA10O1__minSpecialCharacters__c').isEmpty() || extract('CA10O1__minSpecialCharacters__c') < number(1.0) runtimeError: {} - id: test12 match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 800 actual: 800 conditionText: expected: otherwise actual: otherwise runtimeError: {} usedFiles: - path: /ce/ca/oracle/iam/domain-password-policy-weak-complexity/policy.yaml md5Hash: A9B3CAC8AFC5A525DCF3EA0371B6F96C content: | --- names: full: "Oracle IAM Domain Password Policy has weak complexity requirements" contextual: "Domain Password Policy has weak complexity requirements" description: > Oracle IAM password policies assigned to groups should require passwords to be at least 14 characters long and require at least one numeric character and at least one special character. Strong password policy baselines reduce exposure to weak local IAM passwords. type: "COMPLIANCE_POLICY" categories: - "SECURITY" frameworkMappings: - "/frameworks/cis-oracle-v3.1.0/01/04" - "/frameworks/cloudaware/identity-and-access-governance/credential-lifecycle-management" similarPolicies: internal: - "dec-x-2e229fb4" - path: /ce/ca/oracle/iam/domain-password-policy-weak-complexity/prod.logic.yaml md5Hash: 82D1ABD88EFACD31D1B24F712BC115B9 content: | --- inputType: "CA10O1__CaOracleIamDomainPasswordPolicy__c" testData: - file: "test-data.json" importExtracts: - file: "/types/CA10O1__CaOracleIamDomainPasswordPolicy__c/object.extracts.yaml" conditions: - status: "INAPPLICABLE" currentStateMessage: "The default password policy is auto-created and is not evaluated by this policy." check: IS_EQUAL: left: EXTRACT: "CA10O1__name__c" right: TEXT: "defaultPasswordPolicy" - status: "INAPPLICABLE" currentStateMessage: "This non-default password policy is not assigned to any Oracle IAM group." check: RELATED_LIST_HAS_NO: status: "COMPLIANT" relationshipName: "CA10O1__Oracle_IAM_Groups__r" - status: "INCOMPLIANT" currentStateMessage: "The assigned simple password policy has a fixed minimum length below 14 characters." remediationMessage: "Assign affected groups to a custom password policy that requires passwords to be at least 14 characters long and includes a numeric or special character." check: IS_EQUAL: left: EXTRACT: "CA10O1__name__c" right: TEXT: "simplePasswordPolicy" - status: "INCOMPLIANT" currentStateMessage: "The assigned standard password policy has a fixed minimum length below 14 characters." remediationMessage: "Assign affected groups to a custom password policy that requires passwords to be at least 14 characters long and includes a numeric or special character." check: IS_EQUAL: left: EXTRACT: "CA10O1__name__c" right: TEXT: "standardPasswordPolicy" - status: "INCOMPLIANT" currentStateMessage: "This assigned password policy minimum length is empty or configured below 14 characters." remediationMessage: "Update this assigned password policy to require passwords to be at least 14 characters long." check: OR: args: - IS_EMPTY: arg: EXTRACT: "CA10O1__passwordLengthMinimum__c" - LESS_THAN: left: EXTRACT: "CA10O1__passwordLengthMinimum__c" right: NUMBER: 14 - status: "INCOMPLIANT" currentStateMessage: "This assigned password policy numeric character minimum is empty or configured below 1." remediationMessage: "Update this assigned password policy to require at least one numeric character." check: OR: args: - IS_EMPTY: arg: EXTRACT: "CA10O1__minNumerals__c" - LESS_THAN: left: EXTRACT: "CA10O1__minNumerals__c" right: NUMBER: 1 - status: "INCOMPLIANT" currentStateMessage: "This assigned password policy special character minimum is empty or configured below 1." remediationMessage: "Update this assigned password policy to require at least one special character." check: OR: args: - IS_EMPTY: arg: EXTRACT: "CA10O1__minSpecialCharacters__c" - LESS_THAN: left: EXTRACT: "CA10O1__minSpecialCharacters__c" right: NUMBER: 1 otherwise: status: "COMPLIANT" currentStateMessage: "This assigned password policy requires a minimum length of at least 14 characters, at least one numeric character, and at least one special character." relatedLists: - relationshipName: "CA10O1__Oracle_IAM_Groups__r" importExtracts: - file: "/types/CA10O1__CaOracleIamGroup2__c/object.extracts.yaml" conditions: [] otherwise: status: "COMPLIANT" currentStateMessage: "This Oracle IAM group is assigned to the password policy." - path: /ce/ca/oracle/iam/domain-password-policy-weak-complexity/test-data.json md5Hash: 774504D3A92D956942FF87438F14F7FB content: | [ { "expectedResult": { "status": "INAPPLICABLE", "conditionIndex": "199", "conditionText": "extract('CA10O1__name__c') == 'defaultPasswordPolicy'", "runtimeError": null }, "context": { "snapshotTime": "2026-04-12T00:00:00Z" }, "Id": "test1", "CA10O1__disappearanceTime__c": null, "CA10O1__name__c": "defaultPasswordPolicy", "CA10O1__passwordLengthMinimum__c": 8, "CA10O1__minNumerals__c": 1, "CA10O1__minSpecialCharacters__c": null, "CA10O1__Oracle_IAM_Groups__r": [] }, { "expectedResult": { "status": "INAPPLICABLE", "conditionIndex": "199", "conditionText": "extract('CA10O1__name__c') == 'defaultPasswordPolicy'", "runtimeError": null }, "context": { "snapshotTime": "2026-04-12T00:00:00Z" }, "Id": "test2", "CA10O1__disappearanceTime__c": null, "CA10O1__name__c": "defaultPasswordPolicy", "CA10O1__passwordLengthMinimum__c": 14, "CA10O1__minNumerals__c": 0, "CA10O1__minSpecialCharacters__c": null, "CA10O1__Oracle_IAM_Groups__r": [] }, { "expectedResult": { "status": "INCOMPLIANT", "conditionIndex": "399", "conditionText": "extract('CA10O1__name__c') == 'simplePasswordPolicy'", "runtimeError": null }, "context": { "snapshotTime": "2026-04-12T00:00:00Z" }, "Id": "test3", "CA10O1__disappearanceTime__c": null, "CA10O1__name__c": "simplePasswordPolicy", "CA10O1__passwordLengthMinimum__c": 8, "CA10O1__minNumerals__c": 1, "CA10O1__minSpecialCharacters__c": null, "CA10O1__Oracle_IAM_Groups__r": [ { "Id": "test3_1", "CA10O1__disappearanceTime__c": null, "Name": "Developers", "CA10O1__iamDomainPasswordPolicy__c": "test3" } ] }, { "expectedResult": { "status": "INCOMPLIANT", "conditionIndex": "499", "conditionText": "extract('CA10O1__name__c') == 'standardPasswordPolicy'", "runtimeError": null }, "context": { "snapshotTime": "2026-04-12T00:00:00Z" }, "Id": "test4", "CA10O1__disappearanceTime__c": null, "CA10O1__name__c": "standardPasswordPolicy", "CA10O1__passwordLengthMinimum__c": 8, "CA10O1__minNumerals__c": 1, "CA10O1__minSpecialCharacters__c": null, "CA10O1__Oracle_IAM_Groups__r": [ { "Id": "test4_1", "CA10O1__disappearanceTime__c": null, "Name": "Administrators", "CA10O1__iamDomainPasswordPolicy__c": "test4" } ] }, { "expectedResult": { "status": "INAPPLICABLE", "conditionIndex": "299", "conditionText": "CA10O1__Oracle_IAM_Groups__r.hasNo(COMPLIANT)", "runtimeError": null }, "context": { "snapshotTime": "2026-04-12T00:00:00Z" }, "Id": "test5", "CA10O1__disappearanceTime__c": null, "CA10O1__name__c": "simplePasswordPolicy", "CA10O1__passwordLengthMinimum__c": 8, "CA10O1__minNumerals__c": 1, "CA10O1__minSpecialCharacters__c": null, "CA10O1__Oracle_IAM_Groups__r": [] }, { "expectedResult": { "status": "INAPPLICABLE", "conditionIndex": "299", "conditionText": "CA10O1__Oracle_IAM_Groups__r.hasNo(COMPLIANT)", "runtimeError": null }, "context": { "snapshotTime": "2026-04-12T00:00:00Z" }, "Id": "test6", "CA10O1__disappearanceTime__c": null, "CA10O1__name__c": "standardPasswordPolicy", "CA10O1__passwordLengthMinimum__c": 8, "CA10O1__minNumerals__c": 1, "CA10O1__minSpecialCharacters__c": null, "CA10O1__Oracle_IAM_Groups__r": [] }, { "expectedResult": { "status": "INAPPLICABLE", "conditionIndex": "199", "conditionText": "extract('CA10O1__name__c') == 'defaultPasswordPolicy'", "runtimeError": null }, "context": { "snapshotTime": "2026-04-12T00:00:00Z" }, "Id": "test7", "CA10O1__disappearanceTime__c": null, "CA10O1__name__c": "defaultPasswordPolicy", "CA10O1__passwordLengthMinimum__c": null, "CA10O1__minNumerals__c": 1, "CA10O1__minSpecialCharacters__c": null, "CA10O1__Oracle_IAM_Groups__r": [] }, { "expectedResult": { "status": "INCOMPLIANT", "conditionIndex": "699", "conditionText": "extract('CA10O1__minNumerals__c').isEmpty() || extract('CA10O1__minNumerals__c') < number(1.0)", "runtimeError": null }, "context": { "snapshotTime": "2026-04-12T00:00:00Z" }, "Id": "test8", "CA10O1__disappearanceTime__c": null, "CA10O1__name__c": "customPasswordPolicy", "CA10O1__passwordLengthMinimum__c": 14, "CA10O1__minNumerals__c": null, "CA10O1__minSpecialCharacters__c": null, "CA10O1__Oracle_IAM_Groups__r": [ { "Id": "test8_1", "CA10O1__disappearanceTime__c": null, "Name": "Privileged Users", "CA10O1__iamDomainPasswordPolicy__c": "test8" } ] }, { "expectedResult": { "status": "INAPPLICABLE", "conditionIndex": "299", "conditionText": "CA10O1__Oracle_IAM_Groups__r.hasNo(COMPLIANT)", "runtimeError": null }, "context": { "snapshotTime": "2026-04-12T00:00:00Z" }, "Id": "test9", "CA10O1__disappearanceTime__c": null, "CA10O1__name__c": "customPasswordPolicy", "CA10O1__passwordLengthMinimum__c": 8, "CA10O1__minNumerals__c": null, "CA10O1__minSpecialCharacters__c": null, "CA10O1__Oracle_IAM_Groups__r": [ { "Id": "test9_1", "CA10O1__disappearanceTime__c": "2026-04-01T00:00:00Z", "Name": "Deleted Group", "CA10O1__iamDomainPasswordPolicy__c": "test9" } ] }, { "expectedResult": { "status": "INCOMPLIANT", "conditionIndex": "599", "conditionText": "extract('CA10O1__passwordLengthMinimum__c').isEmpty() || extract('CA10O1__passwordLengthMinimum__c') < number(14.0)", "runtimeError": null }, "context": { "snapshotTime": "2026-04-12T00:00:00Z" }, "Id": "test10", "CA10O1__disappearanceTime__c": null, "CA10O1__name__c": "customPasswordPolicy", "CA10O1__passwordLengthMinimum__c": 8, "CA10O1__minNumerals__c": 1, "CA10O1__minSpecialCharacters__c": null, "CA10O1__Oracle_IAM_Groups__r": [ { "Id": "test10_1", "CA10O1__disappearanceTime__c": null, "Name": "Developers", "CA10O1__iamDomainPasswordPolicy__c": "test10" } ] }, { "expectedResult": { "status": "INCOMPLIANT", "conditionIndex": "799", "conditionText": "extract('CA10O1__minSpecialCharacters__c').isEmpty() || extract('CA10O1__minSpecialCharacters__c') < number(1.0)", "runtimeError": null }, "context": { "snapshotTime": "2026-04-12T00:00:00Z" }, "Id": "test11", "CA10O1__disappearanceTime__c": null, "CA10O1__name__c": "customPasswordPolicy", "CA10O1__passwordLengthMinimum__c": 14, "CA10O1__minNumerals__c": 1, "CA10O1__minSpecialCharacters__c": null, "CA10O1__Oracle_IAM_Groups__r": [ { "Id": "test11_1", "CA10O1__disappearanceTime__c": null, "Name": "Privileged Users", "CA10O1__iamDomainPasswordPolicy__c": "test11" } ] }, { "expectedResult": { "status": "COMPLIANT", "conditionIndex": "800", "conditionText": "otherwise", "runtimeError": null }, "context": { "snapshotTime": "2026-04-12T00:00:00Z" }, "Id": "test12", "CA10O1__disappearanceTime__c": null, "CA10O1__name__c": "customPasswordPolicy", "CA10O1__passwordLengthMinimum__c": 14, "CA10O1__minNumerals__c": 1, "CA10O1__minSpecialCharacters__c": 1, "CA10O1__Oracle_IAM_Groups__r": [ { "Id": "test12_1", "CA10O1__disappearanceTime__c": null, "Name": "Administrators", "CA10O1__iamDomainPasswordPolicy__c": "test12" } ] } ] - path: /types/CA10O1__CaOracleIamGroup2__c/object.extracts.yaml md5Hash: CC9779AF5A220F1133C93E0D6734D8DA content: | --- extracts: - name: "Name" value: FIELD: path: "Name" undeterminedIf: isEmpty: "Oracle IAM group name should not be empty." - path: /types/CA10O1__CaOracleIamDomainPasswordPolicy__c/object.extracts.yaml md5Hash: C94C963FEE0071D2A78AD5782F88F5DD content: | --- extracts: - name: "CA10O1__name__c" value: FIELD: path: "CA10O1__name__c" # Nullable - name: "CA10O1__passwordLengthMinimum__c" value: FIELD: path: "CA10O1__passwordLengthMinimum__c" # Nullable - name: "CA10O1__minNumerals__c" value: FIELD: path: "CA10O1__minNumerals__c" # Nullable - name: "CA10O1__minSpecialCharacters__c" value: FIELD: path: "CA10O1__minSpecialCharacters__c" script: |- CREATE TEMP FUNCTION mock_ExpectedResult() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "Id" : "test1", "expectedResult" : { "status" : "INAPPLICABLE", "conditionIndex" : "199", "conditionText" : "extract('CA10O1__name__c') == 'defaultPasswordPolicy'", "runtimeError" : null } }, { "Id" : "test2", "expectedResult" : { "status" : "INAPPLICABLE", "conditionIndex" : "199", "conditionText" : "extract('CA10O1__name__c') == 'defaultPasswordPolicy'", "runtimeError" : null } }, { "Id" : "test3", "expectedResult" : { "status" : "INCOMPLIANT", "conditionIndex" : "399", "conditionText" : "extract('CA10O1__name__c') == 'simplePasswordPolicy'", "runtimeError" : null } }, { "Id" : "test4", "expectedResult" : { "status" : "INCOMPLIANT", "conditionIndex" : "499", "conditionText" : "extract('CA10O1__name__c') == 'standardPasswordPolicy'", "runtimeError" : null } }, { "Id" : "test5", "expectedResult" : { "status" : "INAPPLICABLE", "conditionIndex" : "299", "conditionText" : "CA10O1__Oracle_IAM_Groups__r.hasNo(COMPLIANT)", "runtimeError" : null } }, { "Id" : "test6", "expectedResult" : { "status" : "INAPPLICABLE", "conditionIndex" : "299", "conditionText" : "CA10O1__Oracle_IAM_Groups__r.hasNo(COMPLIANT)", "runtimeError" : null } }, { "Id" : "test7", "expectedResult" : { "status" : "INAPPLICABLE", "conditionIndex" : "199", "conditionText" : "extract('CA10O1__name__c') == 'defaultPasswordPolicy'", "runtimeError" : null } }, { "Id" : "test8", "expectedResult" : { "status" : "INCOMPLIANT", "conditionIndex" : "699", "conditionText" : "extract('CA10O1__minNumerals__c').isEmpty() || extract('CA10O1__minNumerals__c') < number(1.0)", "runtimeError" : null } }, { "Id" : "test9", "expectedResult" : { "status" : "INAPPLICABLE", "conditionIndex" : "299", "conditionText" : "CA10O1__Oracle_IAM_Groups__r.hasNo(COMPLIANT)", "runtimeError" : null } }, { "Id" : "test10", "expectedResult" : { "status" : "INCOMPLIANT", "conditionIndex" : "599", "conditionText" : "extract('CA10O1__passwordLengthMinimum__c').isEmpty() || extract('CA10O1__passwordLengthMinimum__c') < number(14.0)", "runtimeError" : null } }, { "Id" : "test11", "expectedResult" : { "status" : "INCOMPLIANT", "conditionIndex" : "799", "conditionText" : "extract('CA10O1__minSpecialCharacters__c').isEmpty() || extract('CA10O1__minSpecialCharacters__c') < number(1.0)", "runtimeError" : null } }, { "Id" : "test12", "expectedResult" : { "status" : "COMPLIANT", "conditionIndex" : "800", "conditionText" : "otherwise", "runtimeError" : null } } ]; """; CREATE TEMP FUNCTION mock_CA10O1__CaOracleIamDomainPasswordPolicy__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__name__c" : "defaultPasswordPolicy", "CA10O1__passwordLengthMinimum__c" : 8, "CA10O1__minNumerals__c" : 1, "CA10O1__minSpecialCharacters__c" : null, "Id" : "test1" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__name__c" : "defaultPasswordPolicy", "CA10O1__passwordLengthMinimum__c" : 14, "CA10O1__minNumerals__c" : 0, "CA10O1__minSpecialCharacters__c" : null, "Id" : "test2" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__name__c" : "simplePasswordPolicy", "CA10O1__passwordLengthMinimum__c" : 8, "CA10O1__minNumerals__c" : 1, "CA10O1__minSpecialCharacters__c" : null, "Id" : "test3" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__name__c" : "standardPasswordPolicy", "CA10O1__passwordLengthMinimum__c" : 8, "CA10O1__minNumerals__c" : 1, "CA10O1__minSpecialCharacters__c" : null, "Id" : "test4" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__name__c" : "simplePasswordPolicy", "CA10O1__passwordLengthMinimum__c" : 8, "CA10O1__minNumerals__c" : 1, "CA10O1__minSpecialCharacters__c" : null, "Id" : "test5" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__name__c" : "standardPasswordPolicy", "CA10O1__passwordLengthMinimum__c" : 8, "CA10O1__minNumerals__c" : 1, "CA10O1__minSpecialCharacters__c" : null, "Id" : "test6" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__name__c" : "defaultPasswordPolicy", "CA10O1__passwordLengthMinimum__c" : null, "CA10O1__minNumerals__c" : 1, "CA10O1__minSpecialCharacters__c" : null, "Id" : "test7" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__name__c" : "customPasswordPolicy", "CA10O1__passwordLengthMinimum__c" : 14, "CA10O1__minNumerals__c" : null, "CA10O1__minSpecialCharacters__c" : null, "Id" : "test8" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__name__c" : "customPasswordPolicy", "CA10O1__passwordLengthMinimum__c" : 8, "CA10O1__minNumerals__c" : null, "CA10O1__minSpecialCharacters__c" : null, "Id" : "test9" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__name__c" : "customPasswordPolicy", "CA10O1__passwordLengthMinimum__c" : 8, "CA10O1__minNumerals__c" : 1, "CA10O1__minSpecialCharacters__c" : null, "Id" : "test10" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__name__c" : "customPasswordPolicy", "CA10O1__passwordLengthMinimum__c" : 14, "CA10O1__minNumerals__c" : 1, "CA10O1__minSpecialCharacters__c" : null, "Id" : "test11" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__name__c" : "customPasswordPolicy", "CA10O1__passwordLengthMinimum__c" : 14, "CA10O1__minNumerals__c" : 1, "CA10O1__minSpecialCharacters__c" : 1, "Id" : "test12" } ]; """; CREATE TEMP FUNCTION mock_CA10O1__CaOracleIamGroup2__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__iamDomainPasswordPolicy__c" : "test3", "Id" : "test3_1" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__iamDomainPasswordPolicy__c" : "test4", "Id" : "test4_1" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__iamDomainPasswordPolicy__c" : "test8", "Id" : "test8_1" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__disappearanceTime__c" : new Date("2026-04-01T00:00:00Z"), "CA10O1__iamDomainPasswordPolicy__c" : "test9", "Id" : "test9_1" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__iamDomainPasswordPolicy__c" : "test10", "Id" : "test10_1" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__iamDomainPasswordPolicy__c" : "test11", "Id" : "test11_1" }, { "context" : { "snapshotTime" : new Date("2026-04-12T00:00:00Z") }, "CA10O1__iamDomainPasswordPolicy__c" : "test12", "Id" : "test12_1" } ]; """; CREATE TEMP FUNCTION process_CA10O1__CaOracleIamDomainPasswordPolicy__c( obj STRUCT< CA10O1__disappearanceTime__c TIMESTAMP, CA10O1__name__c STRING, CA10O1__passwordLengthMinimum__c FLOAT64, CA10O1__minNumerals__c FLOAT64, CA10O1__minSpecialCharacters__c FLOAT64, CA10O1__Oracle_IAM_Groups__r ARRAY >>, Id STRING >, snapshotTime TIMESTAMP ) RETURNS STRUCT DETERMINISTIC LANGUAGE js AS r""" var TextLib = new function () { this.normalize = function(arg) { return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase(); }; this.isEmpty = function(arg) { return this.normalize(arg) == ''; }; this.isNotEmpty = function(arg) { return this.normalize(arg) != ''; }; this.equal = function(left, right) { return this.normalize(left) == this.normalize(right); }; this.notEqual = function(left, right) { return this.normalize(left) != this.normalize(right); }; this.startsWith = function(arg, substring) { return this.normalize(arg).startsWith(this.normalize(substring)); }; this.endsWith = function(arg, substring) { return this.normalize(arg).endsWith(this.normalize(substring)); }; this.contains = function(arg, substring) { return this.normalize(arg).includes(this.normalize(substring)); }; this.containsAll = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.every(sub => normalizedArg.includes(this.normalize(sub))); }; this.containsAny = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.some(sub => normalizedArg.includes(this.normalize(sub))); }; }(); var IsEmptyLib = new function () { this.simpleIsEmpty = function(arg) { return arg == null; }; this.simpleIsNotEmpty = function(arg) { return arg != null; }; }(); var references1 = []; // condition[0], conditionIndex:[0..99] references1.push('Deleted From Oracle [CA10O1__disappearanceTime__c]: ' + obj.CA10O1__disappearanceTime__c); if (obj.CA10O1__disappearanceTime__c != null) { return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10O1__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[1], conditionIndex:[100..199] function extract3() { if (!this.out) { this.out = obj.CA10O1__name__c; } return this.out; }; references1.push('Name [obj.CA10O1__name__c]: ' + obj.CA10O1__name__c); if (TextLib.equal(extract3.call(extract3), 'defaultPasswordPolicy')) { return {status: 'INAPPLICABLE', conditionIndex: 199, conditionText: "extract('CA10O1__name__c') == 'defaultPasswordPolicy'", currentStateMessage: "The default password policy is auto-created and is not evaluated by this policy.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } var count_CA10O1__Oracle_IAM_Groups__r_COMPLIANT5 = 0; if (obj.CA10O1__Oracle_IAM_Groups__r != null) { for (var i6 = 0; i6 < obj.CA10O1__Oracle_IAM_Groups__r.length; i6++) { if (typeof(obj.CA10O1__Oracle_IAM_Groups__r[i6].status) !== 'undefined') { if (obj.CA10O1__Oracle_IAM_Groups__r[i6].status == 'COMPLIANT') { count_CA10O1__Oracle_IAM_Groups__r_COMPLIANT5 += obj.CA10O1__Oracle_IAM_Groups__r[i6].count; } } else { if (obj.CA10O1__Oracle_IAM_Groups__r[i6].result.status == 'COMPLIANT') { count_CA10O1__Oracle_IAM_Groups__r_COMPLIANT5 += 1; } } } } // condition[2], conditionIndex:[200..299] references1.push('Related list [CA10O1__Oracle_IAM_Groups__r] ' + (count_CA10O1__Oracle_IAM_Groups__r_COMPLIANT5 == 0 ? 'does not have' : 'has') + ' objects in COMPLIANT status'); if (count_CA10O1__Oracle_IAM_Groups__r_COMPLIANT5 == 0) { return {status: 'INAPPLICABLE', conditionIndex: 299, conditionText: "CA10O1__Oracle_IAM_Groups__r.hasNo(COMPLIANT)", currentStateMessage: "This non-default password policy is not assigned to any Oracle IAM group.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[3], conditionIndex:[300..399] function extract8() { if (!this.out) { this.out = obj.CA10O1__name__c; } return this.out; }; if (TextLib.equal(extract8.call(extract8), 'simplePasswordPolicy')) { return {status: 'INCOMPLIANT', conditionIndex: 399, conditionText: "extract('CA10O1__name__c') == 'simplePasswordPolicy'", currentStateMessage: "The assigned simple password policy has a fixed minimum length below 14 characters.", currentStateReferences: references1.join('\n'), remediation: "Assign affected groups to a custom password policy that requires passwords to be at least 14 characters long and includes a numeric or special character.", runtimeError: null}; } // condition[4], conditionIndex:[400..499] function extract11() { if (!this.out) { this.out = obj.CA10O1__name__c; } return this.out; }; if (TextLib.equal(extract11.call(extract11), 'standardPasswordPolicy')) { return {status: 'INCOMPLIANT', conditionIndex: 499, conditionText: "extract('CA10O1__name__c') == 'standardPasswordPolicy'", currentStateMessage: "The assigned standard password policy has a fixed minimum length below 14 characters.", currentStateReferences: references1.join('\n'), remediation: "Assign affected groups to a custom password policy that requires passwords to be at least 14 characters long and includes a numeric or special character.", runtimeError: null}; } // condition[5], conditionIndex:[500..599] function extract14() { if (!this.out) { this.out = obj.CA10O1__passwordLengthMinimum__c; } return this.out; }; references1.push('Password Length (minimum) [obj.CA10O1__passwordLengthMinimum__c]: ' + obj.CA10O1__passwordLengthMinimum__c); if (IsEmptyLib.simpleIsEmpty(extract14.call(extract14)) || (extract14.call(extract14) != null && 14.0 != null && extract14.call(extract14) < 14.0)) { return {status: 'INCOMPLIANT', conditionIndex: 599, conditionText: "extract('CA10O1__passwordLengthMinimum__c').isEmpty() || extract('CA10O1__passwordLengthMinimum__c') < number(14.0)", currentStateMessage: "This assigned password policy minimum length is empty or configured below 14 characters.", currentStateReferences: references1.join('\n'), remediation: "Update this assigned password policy to require passwords to be at least 14 characters long.", runtimeError: null}; } // condition[6], conditionIndex:[600..699] function extract19() { if (!this.out) { this.out = obj.CA10O1__minNumerals__c; } return this.out; }; references1.push('Minimum Numerals [obj.CA10O1__minNumerals__c]: ' + obj.CA10O1__minNumerals__c); if (IsEmptyLib.simpleIsEmpty(extract19.call(extract19)) || (extract19.call(extract19) != null && 1.0 != null && extract19.call(extract19) < 1.0)) { return {status: 'INCOMPLIANT', conditionIndex: 699, conditionText: "extract('CA10O1__minNumerals__c').isEmpty() || extract('CA10O1__minNumerals__c') < number(1.0)", currentStateMessage: "This assigned password policy numeric character minimum is empty or configured below 1.", currentStateReferences: references1.join('\n'), remediation: "Update this assigned password policy to require at least one numeric character.", runtimeError: null}; } // condition[7], conditionIndex:[700..799] function extract24() { if (!this.out) { this.out = obj.CA10O1__minSpecialCharacters__c; } return this.out; }; references1.push('Minimum Special Characters [obj.CA10O1__minSpecialCharacters__c]: ' + obj.CA10O1__minSpecialCharacters__c); if (IsEmptyLib.simpleIsEmpty(extract24.call(extract24)) || (extract24.call(extract24) != null && 1.0 != null && extract24.call(extract24) < 1.0)) { return {status: 'INCOMPLIANT', conditionIndex: 799, conditionText: "extract('CA10O1__minSpecialCharacters__c').isEmpty() || extract('CA10O1__minSpecialCharacters__c') < number(1.0)", currentStateMessage: "This assigned password policy special character minimum is empty or configured below 1.", currentStateReferences: references1.join('\n'), remediation: "Update this assigned password policy to require at least one special character.", runtimeError: null}; } return {status: 'COMPLIANT', conditionIndex: 800, conditionText: "otherwise", currentStateMessage: "This assigned password policy requires a minimum length of at least 14 characters, at least one numeric character, and at least one special character.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; """; CREATE TEMP FUNCTION process_CA10O1__Oracle_IAM_Groups__r( obj STRUCT< CA10O1__disappearanceTime__c TIMESTAMP, CA10O1__iamDomainPasswordPolicy__c STRING, Id STRING >, snapshotTime TIMESTAMP ) RETURNS STRUCT DETERMINISTIC LANGUAGE js AS r""" var references1 = []; // condition[0], conditionIndex:[0..99] references1.push('Deleted From Oracle [CA10O1__disappearanceTime__c]: ' + obj.CA10O1__disappearanceTime__c); if (obj.CA10O1__disappearanceTime__c != null) { return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10O1__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } return {status: 'COMPLIANT', conditionIndex: 100, conditionText: "otherwise", currentStateMessage: "This Oracle IAM group is assigned to the password policy.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; """; SELECT expectedResult.Id as Id, IF ( IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '') AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1) AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '') AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''), "MATCH", "FAIL" ) as match, expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus, expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex, expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText, expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError FROM UNNEST(mock_ExpectedResult()) expectedResult LEFT JOIN ( SELECT sObject.CA10O1__disappearanceTime__c AS CA10O1__disappearanceTime__c, sObject.CA10O1__name__c AS CA10O1__name__c, sObject.CA10O1__passwordLengthMinimum__c AS CA10O1__passwordLengthMinimum__c, sObject.CA10O1__minNumerals__c AS CA10O1__minNumerals__c, sObject.CA10O1__minSpecialCharacters__c AS CA10O1__minSpecialCharacters__c, `CA10O1__Oracle_IAM_Groups__r`.arr AS CA10O1__Oracle_IAM_Groups__r, sObject.Id AS Id, process_CA10O1__CaOracleIamDomainPasswordPolicy__c( STRUCT( sObject.CA10O1__disappearanceTime__c AS CA10O1__disappearanceTime__c, sObject.CA10O1__name__c AS CA10O1__name__c, sObject.CA10O1__passwordLengthMinimum__c AS CA10O1__passwordLengthMinimum__c, sObject.CA10O1__minNumerals__c AS CA10O1__minNumerals__c, sObject.CA10O1__minSpecialCharacters__c AS CA10O1__minSpecialCharacters__c, `CA10O1__Oracle_IAM_Groups__r`.arr AS CA10O1__Oracle_IAM_Groups__r, sObject.Id AS Id ), sObject.context.snapshotTime ) as result FROM UNNEST(mock_CA10O1__CaOracleIamDomainPasswordPolicy__c()) AS sObject LEFT JOIN ( SELECT sObject.CA10O1__iamDomainPasswordPolicy__c, ARRAY_AGG( STRUCT( sObject.CA10O1__disappearanceTime__c AS CA10O1__disappearanceTime__c, sObject.CA10O1__iamDomainPasswordPolicy__c AS CA10O1__iamDomainPasswordPolicy__c, sObject.Id AS Id, process_CA10O1__Oracle_IAM_Groups__r( STRUCT( sObject.CA10O1__disappearanceTime__c AS CA10O1__disappearanceTime__c, sObject.CA10O1__iamDomainPasswordPolicy__c AS CA10O1__iamDomainPasswordPolicy__c, sObject.Id AS Id ), sObject.context.snapshotTime ) as result ) ) AS arr FROM UNNEST(mock_CA10O1__CaOracleIamGroup2__c()) AS sObject GROUP BY sObject.CA10O1__iamDomainPasswordPolicy__c ) AS `CA10O1__Oracle_IAM_Groups__r` ON sObject.Id = `CA10O1__Oracle_IAM_Groups__r`.CA10O1__iamDomainPasswordPolicy__c ) sObject ON sObject.Id = expectedResult.Id;