| Vendor | FINOS |
| Product | CCC-Complete (Behavioural) |
| Version | 0.1 |
CCC-Complete (Behavioural) 0.1
Test results for this specific product, vendor, and version combination
Download Raw Results
Download the original OCSF, Gemara, or HTML result files used to generate this page
Test Summary
Aggregate summary of all tests for this configuration result
| Resources In Configuration | 1 |
| Count of Tests | 54 |
| Passing Tests | 22 |
| Failing Tests | 32 |
| Catalogs Tested | CCC.Core |
Control Catalog Summary
Summary of test results grouped by control catalog and resource
Test Mapping Summary
Summary of test mappings showing how event codes map to test requirements
| Control Catalog | Test Requirement | Mapped Tests (Event Code | Total | Passing | Failing) |
|---|---|---|
| CCC.Core | CCC.Core.CN01.AR01 When a port is exposed for non-SSH network traffic, all traffic MUST include a TLS handshake AND be encrypted using TLS 1.3 or higher. | Service accepts TLS 1.3 encrypted traffic220 Service rejects TLS 1.0 traffic220 Service rejects TLS 1.1 traffic220 Service rejects TLS 1.2 traffic220 Verify no known SSL/TLS vulnerabilities202 Verify SSL/TLS protocol support202 Verify TLS 1.3 only certificate validity202 |
| CCC.Core | CCC.Core.CN01.AR02 When a port is exposed for SSH network traffic, all traffic MUST include a SSH handshake AND be encrypted using SSHv2 or higher. | Verify SSH protocol version220 Verify SSH server configuration202 Verify SSH uses strong ciphers202 |
| CCC.Core | CCC.Core.CN01.AR03 When the service receives unencrypted traffic, then it MUST either block the request or automatically redirect it to the secure equivalent. | FTP traffic is blocked or not exposed202 HTTP redirects to HTTPS202 Only secure protocols are exposed202 Telnet traffic is blocked or not exposed202 |
| CCC.Core | CCC.Core.CN01.AR07 When a port is exposed, the service MUST ensure that the protocol and service officially assigned to that port number by the IANA Service Name and Transport Protocol Port Number Registry, and no other, is run on that port. | Verify HTTPS uses IANA-assigned port 443202 |
| CCC.Core | CCC.Core.CN01.AR08 When a service transmits data using TLS, mutual TLS (mTLS) MUST be implemented to require both client and server certificate authentication for all connections. | Verify mTLS requires client certificate authentication202 |
| CCC.Core | CCC.Core.CN02.AR01 When data is stored, it MUST be encrypted using the latest industry-standard encryption methods. | VM attached volumes report encryption enabled220 |
| CCC.Core | CCC.Core.CN03.AR01 When an entity attempts to modify the service through a user interface, the authentication process MUST require multiple identifying factors for authentication. | MFA requirement for destructive operations cannot be tested automatically - NotTestable220 |
| CCC.Core | CCC.Core.CN04.AR01 When administrative access or configuration change is attempted on the service or a child resource, the service MUST log the client identity, time, and result of the attempt. | Verify admin actions are logged with identity and timestamp202 |
| CCC.Core | CCC.Core.CN04.AR02 When any attempt is made to modify data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt. | Verify data modifications are logged with identity and timestamp202 |
| CCC.Core | CCC.Core.CN04.AR03 When any attempt is made to read data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt. | Verify data read operations are logged with identity and timestamp202 |
| CCC.Core | CCC.Core.CN05.AR06 When any request is made to the service or a child resource, the service MUST refuse requests from unauthorized entities. | Service prevents data read by user with no access220 |
| CCC.Core | CCC.Core.CN06.AR01 When the service is running, its region and availability zone MUST be included in a list of explicitly trusted or approved locations within the trust perimeter. | Resource region can be retrieved for compliance verification202 |
| CCC.Core | CCC.Core.CN07.AR01 When enumeration activities are detected, the service MUST publish an event to a monitored channel which includes the client identity, time, and nature of the activity. | Enumeration event publishing cannot be tested automatically - NotTestable220 |
| CCC.Core | CCC.Core.CN07.AR02 When enumeration activities are detected, the service MUST log the client identity, time, and nature of the activity. | Enumeration logging cannot be verified automatically - NotTestable220 |
| CCC.Core | CCC.Core.CN10.AR01 When data is replicated, the service MUST ensure that replication only occurs to destinations that are explicitly included within the defined trust perimeter. | Replication destination trust cannot be verified automatically - NotTestable220 |
| CCC.Core | CCC.Core.CN12.AR01 Description not available | Unauthorized inbound connection attempt is denied202 |
Resource Summary
Summary of all resources mentioned in OCSF results
| Resource Name | Resource Type | Control Catalogs | Total Tests | Passing | Failing |
|---|---|---|---|---|---|
avmvm20260611 | virtual-machines | CCC.Core | 54 | 22 | 32 |
Test Results
OCSF test results filtered for entries with CCC compliance mappings
| Status | Finding | Resource Name | Resource Type | Message | Test Requirements |
|---|---|---|---|---|---|
| PASS | VM attached volumes report encryption enabled ✓ a cloud api for "{config}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "virtual-machines"
✓ I refer to "{result}" as "vmService"
✓ I call "{vmService}" with "GetVolumeEncryptionStatus" using argument "{uid}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "encryption"
✓ I attach "{encryption}" to the test output as "Volume Encryption Status"
✓ "{encryption.Volumes}" is an array of objects with at least the following contents | avmvm20260611 | virtual-machines | VM attached volumes report encryption enabled | |
| FAIL | Unauthorized inbound connection attempt is denied ✓ a cloud api for "{config}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "virtual-machines"
✓ I refer to "{result}" as "vmService"
✓ I call "{vmService}" with "AttemptInboundConnection" using arguments "{uid}" and "{test-listener-port}"
✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: hostName is required for inbound connection checks
⊘ I refer to "{result}" as "probe" (skipped)
⊘ I attach "{probe}" to the test output as "Inbound Connection Probe" (skipped)
⊘ "{probe.Connected}" is "false" (skipped) | avmvm20260611 | virtual-machines | Unauthorized inbound connection attempt is denied | CCC.Core.CN12.AR01 |
| PASS | Service accepts TLS 1.3 encrypted traffic ✓ a cloud api for "{config}" in "api"
✓ an openssl s_client request using "tls1_3" to "{port-number}" on "{host-name}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ "{connection}" state is open
✓ "{connection.State}" is "open"
✓ I close connection "{connection}"
✓ "{connection}" state is closed | avmvm20260611 | virtual-machines | Service accepts TLS 1.3 encrypted traffic | |
| PASS | Service rejects TLS 1.2 traffic ✓ a cloud api for "{config}" in "api"
✓ an openssl s_client request using "tls1_2" to "{port-number}" on "{host-name}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ we wait for a period of "40" ms
✓ "{connection.State}" is "closed" | avmvm20260611 | virtual-machines | Service rejects TLS 1.2 traffic | |
| PASS | Service rejects TLS 1.1 traffic ✓ a cloud api for "{config}" in "api"
✓ an openssl s_client request using "tls1_1" to "{port-number}" on "{host-name}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ we wait for a period of "40" ms
✓ "{connection.State}" is "closed" | avmvm20260611 | virtual-machines | Service rejects TLS 1.1 traffic | |
| PASS | Service rejects TLS 1.0 traffic ✓ a cloud api for "{config}" in "api"
✓ an openssl s_client request using "tls1" to "{port-number}" on "{host-name}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ we wait for a period of "40" ms
✓ "{connection.State}" is "closed" | avmvm20260611 | virtual-machines | Service rejects TLS 1.0 traffic | |
| FAIL | Verify SSL/TLS protocol support ✓ a cloud api for "{config}" in "api"
✗ "report" contains details of SSL Support type "protocols" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_protocols__22.json: no such file or directory
⊘ "{report}" is an array of objects which doesn't contain any of (skipped)
⊘ "{report}" is an array of objects with at least the following contents (skipped) | avmvm20260611 | virtual-machines | Verify SSL/TLS protocol support | |
| FAIL | Verify no known SSL/TLS vulnerabilities ✓ a cloud api for "{config}" in "api"
✗ "report" contains details of SSL Support type "vulnerable" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_vulnerable__22.json: no such file or directory
⊘ "{report}" is an array of objects with at least the following contents (skipped) | avmvm20260611 | virtual-machines | Verify no known SSL/TLS vulnerabilities | |
| FAIL | Verify TLS 1.3 only certificate validity ✓ a cloud api for "{config}" in "api"
✗ "report" contains details of SSL Support type "server-defaults" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_server-defaults__22.json: no such file or directory
⊘ "{report}" is an array of objects with at least the following contents (skipped) | avmvm20260611 | virtual-machines | Verify TLS 1.3 only certificate validity | |
| PASS | Verify SSH protocol version ✓ an openssl s_client request to "{port-number}" on "{host-name}" protocol "ssh"
✓ I refer to "{result}" as "connection"
✓ "{connection}" state is open
✓ I close connection "{connection}"
✓ "{connection}" state is closed | avmvm20260611 | virtual-machines | Verify SSH protocol version | |
| FAIL | Verify SSH uses strong ciphers ✗ "report" contains details of SSL Support type "each-cipher" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_each-cipher__22.json: no such file or directory
⊘ "{report}" is an array of objects which doesn't contain any of (skipped) | avmvm20260611 | virtual-machines | Verify SSH uses strong ciphers | |
| FAIL | Verify SSH server configuration ✗ "report" contains details of SSL Support type "server-defaults" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_server-defaults__22.json: no such file or directory
⊘ "{report}" is an array of objects with at least the following contents (skipped) | avmvm20260611 | virtual-machines | Verify SSH server configuration | |
| FAIL | HTTP redirects to HTTPS ✓ a client connects to "{host-name}" with protocol "http" on port "80"
✓ I refer to "{result}" as "connection"
✓ "{connection}" is not an error
✓ I transmit "GET / HTTP/1.1\r\nHost: {host-name}\r\n\r\n" to "{connection}"
✓ I attach "{connection}" to the test output as "HTTP response"
✗ "{connection.Output}" contains "301" - Error: expected {connection.Output} to contain '301', but got ''
⊘ I call "{connection}" with "Close" (skipped)
⊘ "{connection.State}" is "closed" (skipped) | avmvm20260611 | virtual-machines | HTTP redirects to HTTPS | |
| FAIL | FTP traffic is blocked or not exposed ✓ a client connects to "{host-name}" with protocol "ftp" on port "21"
✓ I attach "{connection}" to the test output as "FTP response"
✓ I refer to "{result}" as "connection"
✗ "{connection}" is an error - Error: expected {connection} to be an error, got *cloud.Connection | avmvm20260611 | virtual-machines | FTP traffic is blocked or not exposed | |
| FAIL | Telnet traffic is blocked or not exposed ✓ a client connects to "{host-name}" with protocol "telnet" on port "23"
✓ I attach "{connection}" to the test output as "Telnet response"
✓ I refer to "{result}" as "connection"
✗ "{connection}" is an error - Error: expected {connection} to be an error, got *cloud.Connection | avmvm20260611 | virtual-machines | Telnet traffic is blocked or not exposed | |
| FAIL | Only secure protocols are exposed ✗ "report" contains details of SSL Support type "protocols" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_protocols__22.json: no such file or directory
⊘ "{report}" is an array of objects with at least the following contents (skipped) | avmvm20260611 | virtual-machines | Only secure protocols are exposed | |
| FAIL | Verify HTTPS uses IANA-assigned port 443 ✗ "{port-number}" is "443" - Error: expected {port-number} to equal '443', got '22' | avmvm20260611 | virtual-machines | Verify HTTPS uses IANA-assigned port 443 | |
| FAIL | Verify mTLS requires client certificate authentication ✗ "report" contains details of SSL Support type "server-defaults" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_server-defaults__22.json: no such file or directory
⊘ "{report}" is an array of objects with at least the following contents (skipped) | avmvm20260611 | virtual-machines | Verify mTLS requires client certificate authentication | |
| PASS | MFA requirement for destructive operations cannot be tested automatically - NotTestable ✓ a cloud api for "{config}" in "api"
✓ no-op required | avmvm20260611 | virtual-machines | MFA requirement for destructive operations cannot be tested automatically - NotTestable | |
| FAIL | Verify admin actions are logged with identity and timestamp ✓ a cloud api for "{config}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "{service-type}"
✓ I refer to "{result}" as "theService"
✓ I call "{api}" with "GetServiceAPI" using argument "logging"
✓ I refer to "{result}" as "loggingService"
✓ I call "{theService}" with "UpdateResourcePolicy"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "Policy Update Result"
✓ we wait for a period of "10000" ms
✓ I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "admin", and "{20}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "adminLogs"
✓ I attach "{adminLogs}" to the test output as "Admin Activity Logs"
✗ "{adminLogs}" is an array of objects with at least the following contents - Error: expected row not found: map[result:Succeeded] | avmvm20260611 | virtual-machines | Verify admin actions are logged with identity and timestamp | |
| FAIL | Verify data modifications are logged with identity and timestamp ✓ a cloud api for "{config}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "{service-type}"
✓ I refer to "{result}" as "theService"
✓ I call "{api}" with "GetServiceAPI" using argument "logging"
✓ I refer to "{result}" as "loggingService"
✓ I call "{theService}" with "TriggerDataWrite" using argument "{resource-name}"
✓ I attach "{result}" to the test output as "Data Write Trigger Result"
✓ we wait for a period of "10000" ms
✓ I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "data-write", and "{20}"
✓ I refer to "{result}" as "dataLogs"
✓ I attach "{dataLogs}" to the test output as "Data Write Logs"
✗ "{dataLogs}" is an array of objects with at least the following contents - Error: field {dataLogs} is not an array | avmvm20260611 | virtual-machines | Verify data modifications are logged with identity and timestamp | |
| FAIL | Verify data read operations are logged with identity and timestamp ✓ a cloud api for "{config}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "{service-type}"
✓ I refer to "{result}" as "theService"
✓ I call "{api}" with "GetServiceAPI" using argument "logging"
✓ I refer to "{result}" as "loggingService"
✓ I call "{theService}" with "TriggerDataRead" using argument "{resource-name}"
✓ I attach "{result}" to the test output as "Data Read Trigger Result"
✓ we wait for a period of "10000" ms
✓ I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "data-read", and "{20}"
✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: azure-log-analytics-workspace-id is required to query data logs but is not set in config
⊘ I refer to "{result}" as "readLogs" (skipped)
⊘ I attach "{readLogs}" to the test output as "Data Read Logs" (skipped)
⊘ "{readLogs}" is an array of objects with at least the following contents (skipped) | avmvm20260611 | virtual-machines | Verify data read operations are logged with identity and timestamp | |
| PASS | Service prevents data read by user with no access ✓ a cloud api for "{config}" in "api"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "{service-type}" and "test-user-no-access"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userReadableService"
✓ I call "{userReadableService}" with "TriggerDataRead" using argument "{resource-name}"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "no-access-trigger-data-read-error.txt" | avmvm20260611 | virtual-machines | Service prevents data read by user with no access | |
| PASS | Enumeration event publishing cannot be tested automatically - NotTestable ✓ a cloud api for "{config}" in "api"
✓ no-op required | avmvm20260611 | virtual-machines | Enumeration event publishing cannot be tested automatically - NotTestable | |
| PASS | Enumeration logging cannot be verified automatically - NotTestable ✓ a cloud api for "{config}" in "api"
✓ no-op required | avmvm20260611 | virtual-machines | Enumeration logging cannot be verified automatically - NotTestable | |
| PASS | Replication destination trust cannot be verified automatically - NotTestable ✓ a cloud api for "{config}" in "api"
✓ no-op required | avmvm20260611 | virtual-machines | Replication destination trust cannot be verified automatically - NotTestable | |
| FAIL | Resource region can be retrieved for compliance verification ✓ a cloud api for "{config}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "{service-type}"
✓ I refer to "{result}" as "theService"
✓ I call "{theService}" with "GetResourceRegion" using argument "{resource-name}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "region"
✓ I attach "{region}" to the test output as "Resource Region"
✗ "{permitted-regions}" is an array of objects with at least the following contents - Error: expected row not found: map[value:{region}] | avmvm20260611 | virtual-machines | Resource region can be retrieved for compliance verification | |
| PASS | VM attached volumes report encryption enabled ✓ a cloud api for "{config}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "virtual-machines"
✓ I refer to "{result}" as "vmService"
✓ I call "{vmService}" with "GetVolumeEncryptionStatus" using argument "{uid}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "encryption"
✓ I attach "{encryption}" to the test output as "Volume Encryption Status"
✓ "{encryption.Volumes}" is an array of objects with at least the following contents | avmvm20260611 | virtual-machines | VM attached volumes report encryption enabled | |
| FAIL | Unauthorized inbound connection attempt is denied ✓ a cloud api for "{config}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "virtual-machines"
✓ I refer to "{result}" as "vmService"
✓ I call "{vmService}" with "AttemptInboundConnection" using arguments "{uid}" and "{test-listener-port}"
✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: hostName is required for inbound connection checks
⊘ I refer to "{result}" as "probe" (skipped)
⊘ I attach "{probe}" to the test output as "Inbound Connection Probe" (skipped)
⊘ "{probe.Connected}" is "false" (skipped) | avmvm20260611 | virtual-machines | Unauthorized inbound connection attempt is denied | CCC.Core.CN12.AR01 |
| PASS | Service accepts TLS 1.3 encrypted traffic ✓ a cloud api for "{config}" in "api"
✓ an openssl s_client request using "tls1_3" to "{port-number}" on "{host-name}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ "{connection}" state is open
✓ "{connection.State}" is "open"
✓ I close connection "{connection}"
✓ "{connection}" state is closed | avmvm20260611 | virtual-machines | Service accepts TLS 1.3 encrypted traffic | |
| PASS | Service rejects TLS 1.2 traffic ✓ a cloud api for "{config}" in "api"
✓ an openssl s_client request using "tls1_2" to "{port-number}" on "{host-name}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ we wait for a period of "40" ms
✓ "{connection.State}" is "closed" | avmvm20260611 | virtual-machines | Service rejects TLS 1.2 traffic | |
| PASS | Service rejects TLS 1.1 traffic ✓ a cloud api for "{config}" in "api"
✓ an openssl s_client request using "tls1_1" to "{port-number}" on "{host-name}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ we wait for a period of "40" ms
✓ "{connection.State}" is "closed" | avmvm20260611 | virtual-machines | Service rejects TLS 1.1 traffic | |
| PASS | Service rejects TLS 1.0 traffic ✓ a cloud api for "{config}" in "api"
✓ an openssl s_client request using "tls1" to "{port-number}" on "{host-name}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ we wait for a period of "40" ms
✓ "{connection.State}" is "closed" | avmvm20260611 | virtual-machines | Service rejects TLS 1.0 traffic | |
| FAIL | Verify SSL/TLS protocol support ✓ a cloud api for "{config}" in "api"
✗ "report" contains details of SSL Support type "protocols" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_protocols__22.json: no such file or directory
⊘ "{report}" is an array of objects which doesn't contain any of (skipped)
⊘ "{report}" is an array of objects with at least the following contents (skipped) | avmvm20260611 | virtual-machines | Verify SSL/TLS protocol support | |
| FAIL | Verify no known SSL/TLS vulnerabilities ✓ a cloud api for "{config}" in "api"
✗ "report" contains details of SSL Support type "vulnerable" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_vulnerable__22.json: no such file or directory
⊘ "{report}" is an array of objects with at least the following contents (skipped) | avmvm20260611 | virtual-machines | Verify no known SSL/TLS vulnerabilities | |
| FAIL | Verify TLS 1.3 only certificate validity ✓ a cloud api for "{config}" in "api"
✗ "report" contains details of SSL Support type "server-defaults" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_server-defaults__22.json: no such file or directory
⊘ "{report}" is an array of objects with at least the following contents (skipped) | avmvm20260611 | virtual-machines | Verify TLS 1.3 only certificate validity | |
| PASS | Verify SSH protocol version ✓ an openssl s_client request to "{port-number}" on "{host-name}" protocol "ssh"
✓ I refer to "{result}" as "connection"
✓ "{connection}" state is open
✓ I close connection "{connection}"
✓ "{connection}" state is closed | avmvm20260611 | virtual-machines | Verify SSH protocol version | |
| FAIL | Verify SSH uses strong ciphers ✗ "report" contains details of SSL Support type "each-cipher" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_each-cipher__22.json: no such file or directory
⊘ "{report}" is an array of objects which doesn't contain any of (skipped) | avmvm20260611 | virtual-machines | Verify SSH uses strong ciphers | |
| FAIL | Verify SSH server configuration ✗ "report" contains details of SSL Support type "server-defaults" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_server-defaults__22.json: no such file or directory
⊘ "{report}" is an array of objects with at least the following contents (skipped) | avmvm20260611 | virtual-machines | Verify SSH server configuration | |
| FAIL | HTTP redirects to HTTPS ✓ a client connects to "{host-name}" with protocol "http" on port "80"
✓ I refer to "{result}" as "connection"
✓ "{connection}" is not an error
✓ I transmit "GET / HTTP/1.1\r\nHost: {host-name}\r\n\r\n" to "{connection}"
✓ I attach "{connection}" to the test output as "HTTP response"
✗ "{connection.Output}" contains "301" - Error: expected {connection.Output} to contain '301', but got ''
⊘ I call "{connection}" with "Close" (skipped)
⊘ "{connection.State}" is "closed" (skipped) | avmvm20260611 | virtual-machines | HTTP redirects to HTTPS | |
| FAIL | FTP traffic is blocked or not exposed ✓ a client connects to "{host-name}" with protocol "ftp" on port "21"
✓ I attach "{connection}" to the test output as "FTP response"
✓ I refer to "{result}" as "connection"
✗ "{connection}" is an error - Error: expected {connection} to be an error, got *cloud.Connection | avmvm20260611 | virtual-machines | FTP traffic is blocked or not exposed | |
| FAIL | Telnet traffic is blocked or not exposed ✓ a client connects to "{host-name}" with protocol "telnet" on port "23"
✓ I attach "{connection}" to the test output as "Telnet response"
✓ I refer to "{result}" as "connection"
✗ "{connection}" is an error - Error: expected {connection} to be an error, got *cloud.Connection | avmvm20260611 | virtual-machines | Telnet traffic is blocked or not exposed | |
| FAIL | Only secure protocols are exposed ✗ "report" contains details of SSL Support type "protocols" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_protocols__22.json: no such file or directory
⊘ "{report}" is an array of objects with at least the following contents (skipped) | avmvm20260611 | virtual-machines | Only secure protocols are exposed | |
| FAIL | Verify HTTPS uses IANA-assigned port 443 ✗ "{port-number}" is "443" - Error: expected {port-number} to equal '443', got '22' | avmvm20260611 | virtual-machines | Verify HTTPS uses IANA-assigned port 443 | |
| FAIL | Verify mTLS requires client certificate authentication ✗ "report" contains details of SSL Support type "server-defaults" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_server-defaults__22.json: no such file or directory
⊘ "{report}" is an array of objects with at least the following contents (skipped) | avmvm20260611 | virtual-machines | Verify mTLS requires client certificate authentication | |
| PASS | MFA requirement for destructive operations cannot be tested automatically - NotTestable ✓ a cloud api for "{config}" in "api"
✓ no-op required | avmvm20260611 | virtual-machines | MFA requirement for destructive operations cannot be tested automatically - NotTestable | |
| FAIL | Verify admin actions are logged with identity and timestamp ✓ a cloud api for "{config}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "{service-type}"
✓ I refer to "{result}" as "theService"
✓ I call "{api}" with "GetServiceAPI" using argument "logging"
✓ I refer to "{result}" as "loggingService"
✓ I call "{theService}" with "UpdateResourcePolicy"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "Policy Update Result"
✓ we wait for a period of "10000" ms
✓ I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "admin", and "{20}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "adminLogs"
✓ I attach "{adminLogs}" to the test output as "Admin Activity Logs"
✗ "{adminLogs}" is an array of objects with at least the following contents - Error: expected row not found: map[result:Succeeded] | avmvm20260611 | virtual-machines | Verify admin actions are logged with identity and timestamp | |
| FAIL | Verify data modifications are logged with identity and timestamp ✓ a cloud api for "{config}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "{service-type}"
✓ I refer to "{result}" as "theService"
✓ I call "{api}" with "GetServiceAPI" using argument "logging"
✓ I refer to "{result}" as "loggingService"
✓ I call "{theService}" with "TriggerDataWrite" using argument "{resource-name}"
✓ I attach "{result}" to the test output as "Data Write Trigger Result"
✓ we wait for a period of "10000" ms
✓ I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "data-write", and "{20}"
✓ I refer to "{result}" as "dataLogs"
✓ I attach "{dataLogs}" to the test output as "Data Write Logs"
✗ "{dataLogs}" is an array of objects with at least the following contents - Error: field {dataLogs} is not an array | avmvm20260611 | virtual-machines | Verify data modifications are logged with identity and timestamp | |
| FAIL | Verify data read operations are logged with identity and timestamp ✓ a cloud api for "{config}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "{service-type}"
✓ I refer to "{result}" as "theService"
✓ I call "{api}" with "GetServiceAPI" using argument "logging"
✓ I refer to "{result}" as "loggingService"
✓ I call "{theService}" with "TriggerDataRead" using argument "{resource-name}"
✓ I attach "{result}" to the test output as "Data Read Trigger Result"
✓ we wait for a period of "10000" ms
✓ I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "data-read", and "{20}"
✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: azure-log-analytics-workspace-id is required to query data logs but is not set in config
⊘ I refer to "{result}" as "readLogs" (skipped)
⊘ I attach "{readLogs}" to the test output as "Data Read Logs" (skipped)
⊘ "{readLogs}" is an array of objects with at least the following contents (skipped) | avmvm20260611 | virtual-machines | Verify data read operations are logged with identity and timestamp | |
| PASS | Service prevents data read by user with no access ✓ a cloud api for "{config}" in "api"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "{service-type}" and "test-user-no-access"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userReadableService"
✓ I call "{userReadableService}" with "TriggerDataRead" using argument "{resource-name}"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "no-access-trigger-data-read-error.txt" | avmvm20260611 | virtual-machines | Service prevents data read by user with no access | |
| PASS | Enumeration event publishing cannot be tested automatically - NotTestable ✓ a cloud api for "{config}" in "api"
✓ no-op required | avmvm20260611 | virtual-machines | Enumeration event publishing cannot be tested automatically - NotTestable | |
| PASS | Enumeration logging cannot be verified automatically - NotTestable ✓ a cloud api for "{config}" in "api"
✓ no-op required | avmvm20260611 | virtual-machines | Enumeration logging cannot be verified automatically - NotTestable | |
| PASS | Replication destination trust cannot be verified automatically - NotTestable ✓ a cloud api for "{config}" in "api"
✓ no-op required | avmvm20260611 | virtual-machines | Replication destination trust cannot be verified automatically - NotTestable | |
| FAIL | Resource region can be retrieved for compliance verification ✓ a cloud api for "{config}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "{service-type}"
✓ I refer to "{result}" as "theService"
✓ I call "{theService}" with "GetResourceRegion" using argument "{resource-name}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "region"
✓ I attach "{region}" to the test output as "Resource Region"
✗ "{permitted-regions}" is an array of objects with at least the following contents - Error: expected row not found: map[value:{region}] | avmvm20260611 | virtual-machines | Resource region can be retrieved for compliance verification |