🧠 AWS WorkSpace instance EBS volumes are not encrypted - prod.logic.yaml🟢

• Contextual name: 🧠 prod.logic.yaml🟢
• ID: /ce/ca/aws/workspaces/workspace-storage-encryption/prod.logic.yaml
• Tags:
  • 🟢 Logic test success
  • 🟢 Logic with extracts
  • 🟢 Logic with test data

Uses

• 📗 AWS WorkSpace
• 🔌 AWS WorkSpace - object.extracts.yaml
• 🧪 test-data.json

Test Results 🟢

Generated at: 2026-01-31T12:02:24.538389207Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	001	✔️ 99	✔️ isDisappeared(CA10__disappearanceTime__c)	✔️ null
🟢	002	✔️ 299	✔️ extract('CA10__rootVolumeEncryptionEnabled__c') == false && extract('CA10__userVolumeEncryptionEnabled__c') == false	✔️ null
🟢	003	✔️ 500	✔️ otherwise	✔️ null
🟢	004	✔️ 399	✔️ extract('CA10__rootVolumeEncryptionEnabled__c') == false	✔️ null
🟢	005	✔️ 499	✔️ extract('CA10__userVolumeEncryptionEnabled__c') == false	✔️ null

Generation Bundle

	File	MD5
Open	/ce/ca/aws/workspaces/workspace-storage-encryption/policy.yaml	3EE79C07FE0BBEA4E639E61EA81FD1E7
Open	/ce/ca/aws/workspaces/workspace-storage-encryption/prod.logic.yaml	D8BC2C88270BBA4803C1824FA0C80BF6
Open	/ce/ca/aws/workspaces/workspace-storage-encryption/test-data.json	2EA437E0545AD2D141F3B1D7B3111347
Open	/types/CA10__CaAwsWorkspace__c/object.extracts.yaml	653A7214D9FA947DB5A00F602EFFCB5C

Available Commands

repo-manager policies generate FULL /ce/ca/aws/workspaces/workspace-storage-encryption/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/aws/workspaces/workspace-storage-encryption/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/aws/workspaces/workspace-storage-encryption/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/aws/workspaces/workspace-storage-encryption/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/aws/workspaces/workspace-storage-encryption/prod.logic.yaml

Content

Open File

---
inputType: "CA10__CaAwsWorkspace__c"
testData:
  - file: "test-data.json"
importExtracts:
  - file: "/types/CA10__CaAwsWorkspace__c/object.extracts.yaml"
conditions:
  - status: "INAPPLICABLE"
    currentStateMessage: "The WorkSpace is not available."
    check:
      NOT_EQUAL:
        left:
          EXTRACT: "CA10__state__c"
        right:
          TEXT: "AVAILABLE"
  - status: "INCOMPLIANT"
    currentStateMessage: "Both root and user WorkSpace volumes are not encrypted at rest."
    remediationMessage: "Enable encryption for the WorkSpace volumes."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: CA10__rootVolumeEncryptionEnabled__c
              right:
                BOOLEAN: false
          - IS_EQUAL:
              left:
                EXTRACT: CA10__userVolumeEncryptionEnabled__c
              right:
                BOOLEAN: false
  - status: "INCOMPLIANT"
    currentStateMessage: "The root WorkSpace volume is not encrypted at rest."
    remediationMessage: "Enable encryption for the root volume."
    check:
      IS_EQUAL:
        left:
          EXTRACT: CA10__rootVolumeEncryptionEnabled__c
        right:
          BOOLEAN: false
  - status: "INCOMPLIANT"
    currentStateMessage: "The user WorkSpace volume is not encrypted at rest."
    remediationMessage: "Enable encryption for the user volume."
    check:
      IS_EQUAL:
        left:
          EXTRACT: CA10__userVolumeEncryptionEnabled__c
        right:
          BOOLEAN: false
otherwise:
  status: "COMPLIANT"
  currentStateMessage: "The WorkSpace EBS volumes are encrypted at rest."