[ { "activity_id": 1, "activity_name": "Test", "category_name": "Findings", "category_uid": 2, "class_name": "Compliance Finding", "class_uid": 2004, "finding_info": { "created_time": 1775723175, "created_time_dt": "2026-04-09T08:26:15Z", "desc": "Compliance test scenario: Main check: no default VPC exists", "title": "Main check: no default VPC exists", "types": [], "uid": "ccc-test-2272-1775723175" }, "message": "Main check: no default VPC exists", "metadata": { "event_code": "Main check: no default VPC exists", "product": { "name": "CCC-Complete (Policy)", "uid": "CCC-Complete (Policy)", "vendor_name": "FINOS", "version": "0.1" }, "profiles": [ "@vpc", "@tlp-amber", "@tlp-red", "@CCC.VPC.CN01", "@CCC.VPC.CN01.AR01", "@Policy", "@MAIN", "@CCC.VPC", "@DEFAULT" ], "version": "1.4.0" }, "resources": [ { "cloud_partition": "aws", "data": { "details": " service on :", "metadata": { "findings": [], "name": "vpc-022fefc877eaaa292", "region": "us-east-1", "status": "ACTIVE", "tags": [], "type": "vpc" } }, "group": { "name": "vpc" }, "name": "vpc-022fefc877eaaa292", "region": "us-east-1", "type": "vpc", "uid": "vpc-022fefc877eaaa292" } ], "severity": "Informational", "severity_id": 1, "status": "New", "status_code": "PASS", "status_detail": "✓ a cloud api for \"{Instance}\" in \"api\"\n✓ I call \"{api}\" with \"GetServiceAPI\" using argument \"vpc\"\n✓ I refer to \"{result}\" as \"vpcService\"\n✓ I call \"{vpcService}\" with \"CountDefaultVpcs\"\n✓ \"{result}\" is \"0\"", "status_id": 1, "time": 1775723175, "time_dt": "2026-04-09T08:26:15Z", "type_name": "Compliance Finding: Test", "type_uid": 200401, "unmapped": { "compliance": { "CCC": [ "CCC.VPC.CN01.AR01" ] } } }, { "activity_id": 1, "activity_name": "Test", "category_name": "Findings", "category_uid": 2, "class_name": "Compliance Finding", "class_uid": 2004, "finding_info": { "created_time": 1775723176, "created_time_dt": "2026-04-09T08:26:16Z", "desc": "Compliance test scenario: Main check (config): public subnets do not auto-assign external IPs", "title": "Main check (config): public subnets do not auto-assign external IPs", "types": [], "uid": "ccc-test-2311-1775723176" }, "message": "Main check (config): public subnets do not auto-assign external IPs", "metadata": { "event_code": "Main check (config): public subnets do not auto-assign external IPs", "product": { "name": "CCC-Complete (Policy)", "uid": "CCC-Complete (Policy)", "vendor_name": "FINOS", "version": "0.1" }, "profiles": [ "@vpc", "@tlp-red", "@CCC.VPC.CN02", "@CCC.VPC.CN02.AR01", "@Policy", "@MAIN", "@CCC.VPC", "@DEFAULT" ], "version": "1.4.0" }, "resources": [ { "cloud_partition": "aws", "data": { "details": " service on :", "metadata": { "findings": [], "name": "vpc-022fefc877eaaa292", "region": "us-east-1", "status": "ACTIVE", "tags": [], "type": "vpc" } }, "group": { "name": "vpc" }, "name": "vpc-022fefc877eaaa292", "region": "us-east-1", "type": "vpc", "uid": "vpc-022fefc877eaaa292" } ], "severity": "Medium", "severity_id": 3, "status": "New", "status_code": "FAIL", "status_detail": "✓ a cloud api for \"{Instance}\" in \"api\"\n✓ I call \"{api}\" with \"GetServiceAPI\" using argument \"vpc\"\n✓ I refer to \"{result}\" as \"vpcService\"\n✓ I refer to \"{UID}\" as \"TargetVpcId\"\n✓ I call \"{vpcService}\" with \"EvaluatePublicSubnetDefaultIPControl\" using argument \"{TargetVpcId}\"\n✗ \"{result.ViolatingSubnetCount}\" is \"0\" - Error: expected {result.ViolatingSubnetCount} to equal '0', got '2'\n⊘ \"{result.Reason}\" contains \"disable default public IP\" (skipped)", "status_id": 1, "time": 1775723176, "time_dt": "2026-04-09T08:26:16Z", "type_name": "Compliance Finding: Test", "type_uid": 200401, "unmapped": { "compliance": { "CCC": [ "CCC.VPC.CN02.AR01" ] } } }, { "activity_id": 1, "activity_name": "Test", "category_name": "Findings", "category_uid": 2, "class_name": "Compliance Finding", "class_uid": 2004, "finding_info": { "created_time": 1775723177, "created_time_dt": "2026-04-09T08:26:17Z", "desc": "Compliance test scenario: Behavioural check (active): resource launched in public subnet is not assigned an external IP", "title": "Behavioural check (active): resource launched in public subnet is not assigned an external IP", "types": [], "uid": "ccc-test-2325-1775723177" }, "message": "Behavioural check (active): resource launched in public subnet is not assigned an external IP", "metadata": { "event_code": "Behavioural check (active): resource launched in public subnet is not assigned an external IP", "product": { "name": "CCC-Complete (Behavioural)", "uid": "CCC-Complete (Behavioural)", "vendor_name": "FINOS", "version": "0.1" }, "profiles": [ "@vpc", "@tlp-red", "@CCC.VPC.CN02", "@CCC.VPC.CN02.AR01", "@Behavioural", "@MAIN", "@CCC.VPC" ], "version": "1.4.0" }, "resources": [ { "cloud_partition": "aws", "data": { "details": " service on :", "metadata": { "findings": [], "name": "vpc-022fefc877eaaa292", "region": "us-east-1", "status": "ACTIVE", "tags": [], "type": "vpc" } }, "group": { "name": "vpc" }, "name": "vpc-022fefc877eaaa292", "region": "us-east-1", "type": "vpc", "uid": "vpc-022fefc877eaaa292" } ], "severity": "Medium", "severity_id": 3, "status": "New", "status_code": "FAIL", "status_detail": "✓ a cloud api for \"{Instance}\" in \"api\"\n✓ I call \"{api}\" with \"GetServiceAPI\" using argument \"vpc\"\n✓ I refer to \"{result}\" as \"vpcService\"\n✓ I refer to \"{UID}\" as \"TargetVpcId\"\n✓ I call \"{vpcService}\" with \"SelectPublicSubnetForTest\" using argument \"{TargetVpcId}\"\n✓ I refer to \"{result.SubnetId}\" as \"TestSubnetId\"\n✓ I call \"{vpcService}\" with \"CreateTestResourceInSubnet\" using argument \"{TestSubnetId}\"\n✓ I refer to \"{result.ResourceId}\" as \"TestResourceId\"\n✓ I call \"{vpcService}\" with \"GetResourceExternalIpAssignment\" using argument \"{TestResourceId}\"\n✓ I refer to \"{result.HasExternalIp}\" as \"HasExternalIp\"\n✗ \"{HasExternalIp}\" is false - Error: expected {HasExternalIp} to be falsy, got true (type: bool)\n⊘ I call \"{vpcService}\" with \"DeleteTestResource\" using argument \"{TestResourceId}\" (skipped)\n⊘ \"{result.Deleted}\" is true (skipped)", "status_id": 1, "time": 1775723177, "time_dt": "2026-04-09T08:26:17Z", "type_name": "Compliance Finding: Test", "type_uid": 200401, "unmapped": { "compliance": { "CCC": [ "CCC.VPC.CN02.AR01" ] } } }, { "activity_id": 1, "activity_name": "Test", "category_name": "Findings", "category_uid": 2, "class_name": "Compliance Finding", "class_uid": 2004, "finding_info": { "created_time": 1775723184, "created_time_dt": "2026-04-09T08:26:24Z", "desc": "Compliance test scenario: Enforcement proof (dry-run): all disallowed requesters are denied against in-scope receiver VPC", "title": "Enforcement proof (dry-run): all disallowed requesters are denied against in-scope receiver VPC", "types": [], "uid": "ccc-test-2426-1775723184" }, "message": "Enforcement proof (dry-run): all disallowed requesters are denied against in-scope receiver VPC", "metadata": { "event_code": "Enforcement proof (dry-run): all disallowed requesters are denied against in-scope receiver VPC", "product": { "name": "CCC-Complete", "uid": "CCC-Complete", "vendor_name": "FINOS", "version": "0.1" }, "profiles": [ "@vpc", "@tlp-amber", "@tlp-red", "@CCC.VPC.CN03", "@CCC.VPC.CN03.AR01", "@Destructive", "@MAIN", "@DEFAULT", "@CCC.VPC" ], "version": "1.4.0" }, "resources": [ { "cloud_partition": "aws", "data": { "details": " service on :", "metadata": { "findings": [], "name": "vpc-022fefc877eaaa292", "region": "us-east-1", "status": "ACTIVE", "tags": [], "type": "vpc" } }, "group": { "name": "vpc" }, "name": "vpc-022fefc877eaaa292", "region": "us-east-1", "type": "vpc", "uid": "vpc-022fefc877eaaa292" } ], "severity": "Medium", "severity_id": 3, "status": "New", "status_code": "FAIL", "status_detail": "✓ a cloud api for \"{Instance}\" in \"api\"\n✓ I call \"{api}\" with \"GetServiceAPI\" using argument \"vpc\"\n✓ I refer to \"{result}\" as \"vpcService\"\n✓ I refer to \"{UID}\" as \"ReceiverVpcId\"\n✓ I refer to \"{Cn03NonAllowlistedRequesterVpcId}\" as \"NonAllowlistedRequesterVpcId\"\n✓ I load environment variable \"CN03_PEER_TRIAL_MATRIX_FILE\" as \"PeerTrialMatrixFile\"\n✓ \"{ReceiverVpcId}\" is not nil\n✓ I call \"{vpcService}\" with \"ValidateDisallowListEnforcement\" using argument \"{ReceiverVpcId}\"\n✓ I attach \"{result.Summary}\" to the test output as \"Disallow-list Enforcement Summary\"\n✓ I attach \"{result.Results}\" to the test output as \"Disallow-list Enforcement\"\n✓ \"{result.ListDefined}\" is true\n✓ \"{result.TestedCount}\" should be greater than \"0\"\n✗ \"{result.AllCorrect}\" is true - Error: expected {result.AllCorrect} to be truthy, got false (type: bool)\n⊘ \"{result.ViolationCount}\" is \"0\" (skipped)", "status_id": 1, "time": 1775723184, "time_dt": "2026-04-09T08:26:24Z", "type_name": "Compliance Finding: Test", "type_uid": 200401, "unmapped": { "compliance": { "CCC": [ "CCC.VPC.CN03.AR01" ] } } }, { "activity_id": 1, "activity_name": "Test", "category_name": "Findings", "category_uid": 2, "class_name": "Compliance Finding", "class_uid": 2004, "finding_info": { "created_time": 1775723185, "created_time_dt": "2026-04-09T08:26:25Z", "desc": "Compliance test scenario: Enforcement proof (dry-run): non-allowlisted requester is denied even when not explicitly listed as disallowed", "title": "Enforcement proof (dry-run): non-allowlisted requester is denied even when not explicitly listed as disallowed", "types": [], "uid": "ccc-test-2447-1775723185" }, "message": "Enforcement proof (dry-run): non-allowlisted requester is denied even when not explicitly listed as disallowed", "metadata": { "event_code": "Enforcement proof (dry-run): non-allowlisted requester is denied even when not explicitly listed as disallowed", "product": { "name": "CCC-Complete", "uid": "CCC-Complete", "vendor_name": "FINOS", "version": "0.1" }, "profiles": [ "@vpc", "@tlp-amber", "@tlp-red", "@CCC.VPC.CN03", "@CCC.VPC.CN03.AR01", "@Destructive", "@MAIN", "@CCC.VPC" ], "version": "1.4.0" }, "resources": [ { "cloud_partition": "aws", "data": { "details": " service on :", "metadata": { "findings": [], "name": "vpc-022fefc877eaaa292", "region": "us-east-1", "status": "ACTIVE", "tags": [], "type": "vpc" } }, "group": { "name": "vpc" }, "name": "vpc-022fefc877eaaa292", "region": "us-east-1", "type": "vpc", "uid": "vpc-022fefc877eaaa292" } ], "severity": "Medium", "severity_id": 3, "status": "New", "status_code": "FAIL", "status_detail": "✓ a cloud api for \"{Instance}\" in \"api\"\n✓ I call \"{api}\" with \"GetServiceAPI\" using argument \"vpc\"\n✓ I refer to \"{result}\" as \"vpcService\"\n✓ I refer to \"{UID}\" as \"ReceiverVpcId\"\n✓ I refer to \"{Cn03NonAllowlistedRequesterVpcId}\" as \"NonAllowlistedRequesterVpcId\"\n✓ I load environment variable \"CN03_PEER_TRIAL_MATRIX_FILE\" as \"PeerTrialMatrixFile\"\n✓ \"{ReceiverVpcId}\" is not nil\n✓ \"{NonAllowlistedRequesterVpcId}\" is not nil\n✓ I call \"{vpcService}\" with \"EvaluatePeerAgainstAllowList\" using argument \"{NonAllowlistedRequesterVpcId}\"\n✓ \"{result.AllowedListDefined}\" is true\n✓ \"{result.Allowed}\" is false\n✓ I call \"{vpcService}\" with \"AttemptVpcPeeringDryRun\" using arguments \"{NonAllowlistedRequesterVpcId}\" and \"{ReceiverVpcId}\"\n✗ \"{result.DryRunAllowed}\" is false - Error: expected {result.DryRunAllowed} to be falsy, got true (type: bool)\n⊘ \"{result.AllowListDefined}\" is true (skipped)\n⊘ \"{result.RequesterInAllowList}\" is false (skipped)\n⊘ \"{result.GuardrailExpectation}\" is \"deny\" (skipped)\n⊘ \"{result.GuardrailMismatch}\" is false (skipped)\n⊘ \"{result.ExitCode}\" should be greater than \"0\" (skipped)\n⊘ \"{result.Reason}\" contains \"guardrail aligned\" (skipped)\n⊘ \"{result.ConflictType}\" is \"\" (skipped)", "status_id": 1, "time": 1775723185, "time_dt": "2026-04-09T08:26:25Z", "type_name": "Compliance Finding: Test", "type_uid": 200401, "unmapped": { "compliance": { "CCC": [ "CCC.VPC.CN03.AR01" ] } } }, { "activity_id": 1, "activity_name": "Test", "category_name": "Findings", "category_uid": 2, "class_name": "Compliance Finding", "class_uid": 2004, "finding_info": { "created_time": 1775723185, "created_time_dt": "2026-04-09T08:26:25Z", "desc": "Compliance test scenario: Main check (config): flow logs are active and capture all traffic", "title": "Main check (config): flow logs are active and capture all traffic", "types": [], "uid": "ccc-test-2515-1775723185" }, "message": "Main check (config): flow logs are active and capture all traffic", "metadata": { "event_code": "Main check (config): flow logs are active and capture all traffic", "product": { "name": "CCC-Complete (Policy)", "uid": "CCC-Complete (Policy)", "vendor_name": "FINOS", "version": "0.1" }, "profiles": [ "@vpc", "@tlp-amber", "@tlp-red", "@CCC.VPC.CN04", "@CCC.VPC.CN04.AR01", "@Policy", "@MAIN", "@DEFAULT", "@CCC.VPC" ], "version": "1.4.0" }, "resources": [ { "cloud_partition": "aws", "data": { "details": " service on :", "metadata": { "findings": [], "name": "vpc-022fefc877eaaa292", "region": "us-east-1", "status": "ACTIVE", "tags": [], "type": "vpc" } }, "group": { "name": "vpc" }, "name": "vpc-022fefc877eaaa292", "region": "us-east-1", "type": "vpc", "uid": "vpc-022fefc877eaaa292" } ], "severity": "Medium", "severity_id": 3, "status": "New", "status_code": "FAIL", "status_detail": "✓ a cloud api for \"{Instance}\" in \"api\"\n✓ I call \"{api}\" with \"GetServiceAPI\" using argument \"vpc\"\n✓ I refer to \"{result}\" as \"vpcService\"\n✓ I refer to \"{UID}\" as \"TargetVpcId\"\n✓ I call \"{vpcService}\" with \"EvaluateVpcFlowLogsControl\" using argument \"{TargetVpcId}\"\n✗ \"{result.FlowLogCount}\" should be greater than \"0\" - Error: expected {result.FlowLogCount} (0) to be greater than 0\n⊘ \"{result.NonCompliantCount}\" is \"0\" (skipped)", "status_id": 1, "time": 1775723185, "time_dt": "2026-04-09T08:26:25Z", "type_name": "Compliance Finding: Test", "type_uid": 200401, "unmapped": { "compliance": { "CCC": [ "CCC.VPC.CN04.AR01" ] } } }, { "activity_id": 1, "activity_name": "Test", "category_name": "Findings", "category_uid": 2, "class_name": "Compliance Finding", "class_uid": 2004, "finding_info": { "created_time": 1775723186, "created_time_dt": "2026-04-09T08:26:26Z", "desc": "Compliance test scenario: Behavioral check (active): traffic produces flow log records", "title": "Behavioral check (active): traffic produces flow log records", "types": [], "uid": "ccc-test-2530-1775723186" }, "message": "Behavioral check (active): traffic produces flow log records", "metadata": { "event_code": "Behavioral check (active): traffic produces flow log records", "product": { "name": "CCC-Complete (Behavioural)", "uid": "CCC-Complete (Behavioural)", "vendor_name": "FINOS", "version": "0.1" }, "profiles": [ "@vpc", "@tlp-amber", "@tlp-red", "@CCC.VPC.CN04", "@CCC.VPC.CN04.AR01", "@Behavioural", "@MAIN", "@CCC.VPC" ], "version": "1.4.0" }, "resources": [ { "cloud_partition": "aws", "data": { "details": " service on :", "metadata": { "findings": [], "name": "vpc-022fefc877eaaa292", "region": "us-east-1", "status": "ACTIVE", "tags": [], "type": "vpc" } }, "group": { "name": "vpc" }, "name": "vpc-022fefc877eaaa292", "region": "us-east-1", "type": "vpc", "uid": "vpc-022fefc877eaaa292" } ], "severity": "Medium", "severity_id": 3, "status": "New", "status_code": "FAIL", "status_detail": "✓ a cloud api for \"{Instance}\" in \"api\"\n✓ I call \"{api}\" with \"GetServiceAPI\" using argument \"vpc\"\n✓ I refer to \"{result}\" as \"vpcService\"\n✓ I refer to \"{UID}\" as \"TargetVpcId\"\n✓ I call \"{vpcService}\" with \"PrepareFlowLogDeliveryObservation\" using argument \"{TargetVpcId}\"\n✓ I call \"{vpcService}\" with \"GenerateTestTraffic\" using argument \"{TargetVpcId}\"\n✓ I refer to \"{result.ResourceId}\" as \"TestResourceId\"\n✓ I refer to \"{result.CleanupDeleted}\" as \"TrafficCleanupDeleted\"\n✓ I call \"{vpcService}\" with \"ObserveRecentFlowLogDelivery\" using argument \"{TargetVpcId}\"\n✓ I refer to \"{result.RecordsObserved}\" as \"RecordsObserved\"\n✓ I call \"{vpcService}\" with \"DeleteTestResource\" using argument \"{TestResourceId}\"\n✓ \"{result.Deleted}\" is true\n✓ \"{TrafficCleanupDeleted}\" is true\n✗ \"{RecordsObserved}\" is true - Error: expected {RecordsObserved} to be truthy, got false (type: bool)", "status_id": 1, "time": 1775723186, "time_dt": "2026-04-09T08:26:26Z", "type_name": "Compliance Finding: Test", "type_uid": 200401, "unmapped": { "compliance": { "CCC": [ "CCC.VPC.CN04.AR01" ] } } }, { "activity_id": 1, "activity_name": "Test", "category_name": "Findings", "category_uid": 2, "class_name": "Compliance Finding", "class_uid": 2004, "finding_info": { "created_time": 1775723211, "created_time_dt": "2026-04-09T08:26:51Z", "desc": "Compliance test scenario: Main check: no default VPC exists", "title": "Main check: no default VPC exists", "types": [], "uid": "ccc-test-2272-1775723211" }, "message": "Main check: no default VPC exists", "metadata": { "event_code": "Main check: no default VPC exists", "product": { "name": "CCC-Complete (Policy)", "uid": "CCC-Complete (Policy)", "vendor_name": "FINOS", "version": "0.1" }, "profiles": [ "@vpc", "@tlp-amber", "@tlp-red", "@CCC.VPC.CN01", "@CCC.VPC.CN01.AR01", "@Policy", "@MAIN", "@CCC.VPC", "@DEFAULT" ], "version": "1.4.0" }, "resources": [ { "cloud_partition": "aws", "data": { "details": " service on :", "metadata": { "findings": [], "name": "vpc-0538ea308fdf4f8c4", "region": "us-east-1", "status": "ACTIVE", "tags": [], "type": "vpc" } }, "group": { "name": "vpc" }, "name": "vpc-0538ea308fdf4f8c4", "region": "us-east-1", "type": "vpc", "uid": "vpc-0538ea308fdf4f8c4" } ], "severity": "Informational", "severity_id": 1, "status": "New", "status_code": "PASS", "status_detail": "✓ a cloud api for \"{Instance}\" in \"api\"\n✓ I call \"{api}\" with \"GetServiceAPI\" using argument \"vpc\"\n✓ I refer to \"{result}\" as \"vpcService\"\n✓ I call \"{vpcService}\" with \"CountDefaultVpcs\"\n✓ \"{result}\" is \"0\"", "status_id": 1, "time": 1775723211, "time_dt": "2026-04-09T08:26:51Z", "type_name": "Compliance Finding: Test", "type_uid": 200401, "unmapped": { "compliance": { "CCC": [ "CCC.VPC.CN01.AR01" ] } } }, { "activity_id": 1, "activity_name": "Test", "category_name": "Findings", "category_uid": 2, "class_name": "Compliance Finding", "class_uid": 2004, "finding_info": { "created_time": 1775723212, "created_time_dt": "2026-04-09T08:26:52Z", "desc": "Compliance test scenario: Main check (config): public subnets do not auto-assign external IPs", "title": "Main check (config): public subnets do not auto-assign external IPs", "types": [], "uid": "ccc-test-2311-1775723212" }, "message": "Main check (config): public subnets do not auto-assign external IPs", "metadata": { "event_code": "Main check (config): public subnets do not auto-assign external IPs", "product": { "name": "CCC-Complete (Policy)", "uid": "CCC-Complete (Policy)", "vendor_name": "FINOS", "version": "0.1" }, "profiles": [ "@vpc", "@tlp-red", "@CCC.VPC.CN02", "@CCC.VPC.CN02.AR01", "@Policy", "@MAIN", "@CCC.VPC", "@DEFAULT" ], "version": "1.4.0" }, "resources": [ { "cloud_partition": "aws", "data": { "details": " service on :", "metadata": { "findings": [], "name": "vpc-0538ea308fdf4f8c4", "region": "us-east-1", "status": "ACTIVE", "tags": [], "type": "vpc" } }, "group": { "name": "vpc" }, "name": "vpc-0538ea308fdf4f8c4", "region": "us-east-1", "type": "vpc", "uid": "vpc-0538ea308fdf4f8c4" } ], "severity": "Informational", "severity_id": 1, "status": "New", "status_code": "PASS", "status_detail": "✓ a cloud api for \"{Instance}\" in \"api\"\n✓ I call \"{api}\" with \"GetServiceAPI\" using argument \"vpc\"\n✓ I refer to \"{result}\" as \"vpcService\"\n✓ I refer to \"{UID}\" as \"TargetVpcId\"\n✓ I call \"{vpcService}\" with \"EvaluatePublicSubnetDefaultIPControl\" using argument \"{TargetVpcId}\"\n✓ \"{result.ViolatingSubnetCount}\" is \"0\"\n✓ \"{result.Reason}\" contains \"disable default public IP\"", "status_id": 1, "time": 1775723212, "time_dt": "2026-04-09T08:26:52Z", "type_name": "Compliance Finding: Test", "type_uid": 200401, "unmapped": { "compliance": { "CCC": [ "CCC.VPC.CN02.AR01" ] } } }, { "activity_id": 1, "activity_name": "Test", "category_name": "Findings", "category_uid": 2, "class_name": "Compliance Finding", "class_uid": 2004, "finding_info": { "created_time": 1775723212, "created_time_dt": "2026-04-09T08:26:52Z", "desc": "Compliance test scenario: Behavioural check (active): resource launched in public subnet is not assigned an external IP", "title": "Behavioural check (active): resource launched in public subnet is not assigned an external IP", "types": [], "uid": "ccc-test-2325-1775723212" }, "message": "Behavioural check (active): resource launched in public subnet is not assigned an external IP", "metadata": { "event_code": "Behavioural check (active): resource launched in public subnet is not assigned an external IP", "product": { "name": "CCC-Complete (Behavioural)", "uid": "CCC-Complete (Behavioural)", "vendor_name": "FINOS", "version": "0.1" }, "profiles": [ "@vpc", "@tlp-red", "@CCC.VPC.CN02", "@CCC.VPC.CN02.AR01", "@Behavioural", "@MAIN", "@CCC.VPC" ], "version": "1.4.0" }, "resources": [ { "cloud_partition": "aws", "data": { "details": " service on :", "metadata": { "findings": [], "name": "vpc-0538ea308fdf4f8c4", "region": "us-east-1", "status": "ACTIVE", "tags": [], "type": "vpc" } }, "group": { "name": "vpc" }, "name": "vpc-0538ea308fdf4f8c4", "region": "us-east-1", "type": "vpc", "uid": "vpc-0538ea308fdf4f8c4" } ], "severity": "Informational", "severity_id": 1, "status": "New", "status_code": "PASS", "status_detail": "✓ a cloud api for \"{Instance}\" in \"api\"\n✓ I call \"{api}\" with \"GetServiceAPI\" using argument \"vpc\"\n✓ I refer to \"{result}\" as \"vpcService\"\n✓ I refer to \"{UID}\" as \"TargetVpcId\"\n✓ I call \"{vpcService}\" with \"SelectPublicSubnetForTest\" using argument \"{TargetVpcId}\"\n✓ I refer to \"{result.SubnetId}\" as \"TestSubnetId\"\n✓ I call \"{vpcService}\" with \"CreateTestResourceInSubnet\" using argument \"{TestSubnetId}\"\n✓ I refer to \"{result.ResourceId}\" as \"TestResourceId\"\n✓ I call \"{vpcService}\" with \"GetResourceExternalIpAssignment\" using argument \"{TestResourceId}\"\n✓ I refer to \"{result.HasExternalIp}\" as \"HasExternalIp\"\n✓ \"{HasExternalIp}\" is false\n✓ I call \"{vpcService}\" with \"DeleteTestResource\" using argument \"{TestResourceId}\"\n✓ \"{result.Deleted}\" is true", "status_id": 1, "time": 1775723212, "time_dt": "2026-04-09T08:26:52Z", "type_name": "Compliance Finding: Test", "type_uid": 200401, "unmapped": { "compliance": { "CCC": [ "CCC.VPC.CN02.AR01" ] } } }, { "activity_id": 1, "activity_name": "Test", "category_name": "Findings", "category_uid": 2, "class_name": "Compliance Finding", "class_uid": 2004, "finding_info": { "created_time": 1775723221, "created_time_dt": "2026-04-09T08:27:01Z", "desc": "Compliance test scenario: Enforcement proof (dry-run): all disallowed requesters are denied against in-scope receiver VPC", "title": "Enforcement proof (dry-run): all disallowed requesters are denied against in-scope receiver VPC", "types": [], "uid": "ccc-test-2426-1775723221" }, "message": "Enforcement proof (dry-run): all disallowed requesters are denied against in-scope receiver VPC", "metadata": { "event_code": "Enforcement proof (dry-run): all disallowed requesters are denied against in-scope receiver VPC", "product": { "name": "CCC-Complete", "uid": "CCC-Complete", "vendor_name": "FINOS", "version": "0.1" }, "profiles": [ "@vpc", "@tlp-amber", "@tlp-red", "@CCC.VPC.CN03", "@CCC.VPC.CN03.AR01", "@Destructive", "@MAIN", "@DEFAULT", "@CCC.VPC" ], "version": "1.4.0" }, "resources": [ { "cloud_partition": "aws", "data": { "details": " service on :", "metadata": { "findings": [], "name": "vpc-0538ea308fdf4f8c4", "region": "us-east-1", "status": "ACTIVE", "tags": [], "type": "vpc" } }, "group": { "name": "vpc" }, "name": "vpc-0538ea308fdf4f8c4", "region": "us-east-1", "type": "vpc", "uid": "vpc-0538ea308fdf4f8c4" } ], "severity": "Informational", "severity_id": 1, "status": "New", "status_code": "PASS", "status_detail": "✓ a cloud api for \"{Instance}\" in \"api\"\n✓ I call \"{api}\" with \"GetServiceAPI\" using argument \"vpc\"\n✓ I refer to \"{result}\" as \"vpcService\"\n✓ I refer to \"{UID}\" as \"ReceiverVpcId\"\n✓ I refer to \"{Cn03NonAllowlistedRequesterVpcId}\" as \"NonAllowlistedRequesterVpcId\"\n✓ I load environment variable \"CN03_PEER_TRIAL_MATRIX_FILE\" as \"PeerTrialMatrixFile\"\n✓ \"{ReceiverVpcId}\" is not nil\n✓ I call \"{vpcService}\" with \"ValidateDisallowListEnforcement\" using argument \"{ReceiverVpcId}\"\n✓ I attach \"{result.Summary}\" to the test output as \"Disallow-list Enforcement Summary\"\n✓ I attach \"{result.Results}\" to the test output as \"Disallow-list Enforcement\"\n✓ \"{result.ListDefined}\" is true\n✓ \"{result.TestedCount}\" should be greater than \"0\"\n✓ \"{result.AllCorrect}\" is true\n✓ \"{result.ViolationCount}\" is \"0\"", "status_id": 1, "time": 1775723221, "time_dt": "2026-04-09T08:27:01Z", "type_name": "Compliance Finding: Test", "type_uid": 200401, "unmapped": { "compliance": { "CCC": [ "CCC.VPC.CN03.AR01" ] } } }, { "activity_id": 1, "activity_name": "Test", "category_name": "Findings", "category_uid": 2, "class_name": "Compliance Finding", "class_uid": 2004, "finding_info": { "created_time": 1775723221, "created_time_dt": "2026-04-09T08:27:01Z", "desc": "Compliance test scenario: Enforcement proof (dry-run): non-allowlisted requester is denied even when not explicitly listed as disallowed", "title": "Enforcement proof (dry-run): non-allowlisted requester is denied even when not explicitly listed as disallowed", "types": [], "uid": "ccc-test-2447-1775723221" }, "message": "Enforcement proof (dry-run): non-allowlisted requester is denied even when not explicitly listed as disallowed", "metadata": { "event_code": "Enforcement proof (dry-run): non-allowlisted requester is denied even when not explicitly listed as disallowed", "product": { "name": "CCC-Complete", "uid": "CCC-Complete", "vendor_name": "FINOS", "version": "0.1" }, "profiles": [ "@vpc", "@tlp-amber", "@tlp-red", "@CCC.VPC.CN03", "@CCC.VPC.CN03.AR01", "@Destructive", "@MAIN", "@CCC.VPC" ], "version": "1.4.0" }, "resources": [ { "cloud_partition": "aws", "data": { "details": " service on :", "metadata": { "findings": [], "name": "vpc-0538ea308fdf4f8c4", "region": "us-east-1", "status": "ACTIVE", "tags": [], "type": "vpc" } }, "group": { "name": "vpc" }, "name": "vpc-0538ea308fdf4f8c4", "region": "us-east-1", "type": "vpc", "uid": "vpc-0538ea308fdf4f8c4" } ], "severity": "Informational", "severity_id": 1, "status": "New", "status_code": "PASS", "status_detail": "✓ a cloud api for \"{Instance}\" in \"api\"\n✓ I call \"{api}\" with \"GetServiceAPI\" using argument \"vpc\"\n✓ I refer to \"{result}\" as \"vpcService\"\n✓ I refer to \"{UID}\" as \"ReceiverVpcId\"\n✓ I refer to \"{Cn03NonAllowlistedRequesterVpcId}\" as \"NonAllowlistedRequesterVpcId\"\n✓ I load environment variable \"CN03_PEER_TRIAL_MATRIX_FILE\" as \"PeerTrialMatrixFile\"\n✓ \"{ReceiverVpcId}\" is not nil\n✓ \"{NonAllowlistedRequesterVpcId}\" is not nil\n✓ I call \"{vpcService}\" with \"EvaluatePeerAgainstAllowList\" using argument \"{NonAllowlistedRequesterVpcId}\"\n✓ \"{result.AllowedListDefined}\" is true\n✓ \"{result.Allowed}\" is false\n✓ I call \"{vpcService}\" with \"AttemptVpcPeeringDryRun\" using arguments \"{NonAllowlistedRequesterVpcId}\" and \"{ReceiverVpcId}\"\n✓ \"{result.DryRunAllowed}\" is false\n✓ \"{result.AllowListDefined}\" is true\n✓ \"{result.RequesterInAllowList}\" is false\n✓ \"{result.GuardrailExpectation}\" is \"deny\"\n✓ \"{result.GuardrailMismatch}\" is false\n✓ \"{result.ExitCode}\" should be greater than \"0\"\n✓ \"{result.Reason}\" contains \"guardrail aligned\"\n✓ \"{result.ConflictType}\" is \"\"", "status_id": 1, "time": 1775723221, "time_dt": "2026-04-09T08:27:01Z", "type_name": "Compliance Finding: Test", "type_uid": 200401, "unmapped": { "compliance": { "CCC": [ "CCC.VPC.CN03.AR01" ] } } }, { "activity_id": 1, "activity_name": "Test", "category_name": "Findings", "category_uid": 2, "class_name": "Compliance Finding", "class_uid": 2004, "finding_info": { "created_time": 1775723222, "created_time_dt": "2026-04-09T08:27:02Z", "desc": "Compliance test scenario: Main check (config): flow logs are active and capture all traffic", "title": "Main check (config): flow logs are active and capture all traffic", "types": [], "uid": "ccc-test-2515-1775723222" }, "message": "Main check (config): flow logs are active and capture all traffic", "metadata": { "event_code": "Main check (config): flow logs are active and capture all traffic", "product": { "name": "CCC-Complete (Policy)", "uid": "CCC-Complete (Policy)", "vendor_name": "FINOS", "version": "0.1" }, "profiles": [ "@vpc", "@tlp-amber", "@tlp-red", "@CCC.VPC.CN04", "@CCC.VPC.CN04.AR01", "@Policy", "@MAIN", "@DEFAULT", "@CCC.VPC" ], "version": "1.4.0" }, "resources": [ { "cloud_partition": "aws", "data": { "details": " service on :", "metadata": { "findings": [], "name": "vpc-0538ea308fdf4f8c4", "region": "us-east-1", "status": "ACTIVE", "tags": [], "type": "vpc" } }, "group": { "name": "vpc" }, "name": "vpc-0538ea308fdf4f8c4", "region": "us-east-1", "type": "vpc", "uid": "vpc-0538ea308fdf4f8c4" } ], "severity": "Informational", "severity_id": 1, "status": "New", "status_code": "PASS", "status_detail": "✓ a cloud api for \"{Instance}\" in \"api\"\n✓ I call \"{api}\" with \"GetServiceAPI\" using argument \"vpc\"\n✓ I refer to \"{result}\" as \"vpcService\"\n✓ I refer to \"{UID}\" as \"TargetVpcId\"\n✓ I call \"{vpcService}\" with \"EvaluateVpcFlowLogsControl\" using argument \"{TargetVpcId}\"\n✓ \"{result.FlowLogCount}\" should be greater than \"0\"\n✓ \"{result.NonCompliantCount}\" is \"0\"", "status_id": 1, "time": 1775723222, "time_dt": "2026-04-09T08:27:02Z", "type_name": "Compliance Finding: Test", "type_uid": 200401, "unmapped": { "compliance": { "CCC": [ "CCC.VPC.CN04.AR01" ] } } }, { "activity_id": 1, "activity_name": "Test", "category_name": "Findings", "category_uid": 2, "class_name": "Compliance Finding", "class_uid": 2004, "finding_info": { "created_time": 1775723222, "created_time_dt": "2026-04-09T08:27:02Z", "desc": "Compliance test scenario: Behavioral check (active): traffic produces flow log records", "title": "Behavioral check (active): traffic produces flow log records", "types": [], "uid": "ccc-test-2530-1775723222" }, "message": "Behavioral check (active): traffic produces flow log records", "metadata": { "event_code": "Behavioral check (active): traffic produces flow log records", "product": { "name": "CCC-Complete (Behavioural)", "uid": "CCC-Complete (Behavioural)", "vendor_name": "FINOS", "version": "0.1" }, "profiles": [ "@vpc", "@tlp-amber", "@tlp-red", "@CCC.VPC.CN04", "@CCC.VPC.CN04.AR01", "@Behavioural", "@MAIN", "@CCC.VPC" ], "version": "1.4.0" }, "resources": [ { "cloud_partition": "aws", "data": { "details": " service on :", "metadata": { "findings": [], "name": "vpc-0538ea308fdf4f8c4", "region": "us-east-1", "status": "ACTIVE", "tags": [], "type": "vpc" } }, "group": { "name": "vpc" }, "name": "vpc-0538ea308fdf4f8c4", "region": "us-east-1", "type": "vpc", "uid": "vpc-0538ea308fdf4f8c4" } ], "severity": "Informational", "severity_id": 1, "status": "New", "status_code": "PASS", "status_detail": "✓ a cloud api for \"{Instance}\" in \"api\"\n✓ I call \"{api}\" with \"GetServiceAPI\" using argument \"vpc\"\n✓ I refer to \"{result}\" as \"vpcService\"\n✓ I refer to \"{UID}\" as \"TargetVpcId\"\n✓ I call \"{vpcService}\" with \"PrepareFlowLogDeliveryObservation\" using argument \"{TargetVpcId}\"\n✓ I call \"{vpcService}\" with \"GenerateTestTraffic\" using argument \"{TargetVpcId}\"\n✓ I refer to \"{result.ResourceId}\" as \"TestResourceId\"\n✓ I refer to \"{result.CleanupDeleted}\" as \"TrafficCleanupDeleted\"\n✓ I call \"{vpcService}\" with \"ObserveRecentFlowLogDelivery\" using argument \"{TargetVpcId}\"\n✓ I refer to \"{result.RecordsObserved}\" as \"RecordsObserved\"\n✓ I call \"{vpcService}\" with \"DeleteTestResource\" using argument \"{TestResourceId}\"\n✓ \"{result.Deleted}\" is true\n✓ \"{TrafficCleanupDeleted}\" is true\n✓ \"{RecordsObserved}\" is true", "status_id": 1, "time": 1775723222, "time_dt": "2026-04-09T08:27:02Z", "type_name": "Compliance Finding: Test", "type_uid": 200401, "unmapped": { "compliance": { "CCC": [ "CCC.VPC.CN04.AR01" ] } } } ]