Skip to main content

CCC-Complete (Behavioural) 0.1

Test results for this specific product, vendor, and version combination

VendorFINOS
ProductCCC-Complete (Behavioural)
Version0.1

Download Raw Results

Download the original OCSF, Gemara, or HTML result files used to generate this page

File NameDownload
combined
finos-ccc-integration-container-main-port
finos-ccc-integration-container-main-service
summary
azureStorageBehavioural

Test Summary

Aggregate summary of all tests for this configuration result

Resources In Configuration2
Count of Tests104
Passing Tests48
Failing Tests56
Catalogs Tested
CCC.CoreCCC.ObjStor

Test Mapping Summary

Summary of test mappings showing how event codes map to test requirements

Control CatalogTest RequirementMapped Tests (Event Code | Total | Passing | Failing)
CCC.Core
CCC.Core.CN01.AR01
When a port is exposed for non-SSH network traffic, all traffic MUST include a TLS handshake AND be encrypted using TLS 1.3 or higher.
Service accepts TLS 1.3 encrypted traffic
220
Service rejects TLS 1.0 traffic
220
Service rejects TLS 1.1 traffic
220
Service rejects TLS 1.2 traffic
220
Verify no known SSL/TLS vulnerabilities
202
Verify SSL/TLS protocol support
202
Verify TLS 1.3 only certificate validity
202
CCC.Core
CCC.Core.CN01.AR03
When the service receives unencrypted traffic, then it MUST either block the request or automatically redirect it to the secure equivalent.
HTTP redirects to HTTPS
202
Only secure protocols are exposed
202
CCC.Core
CCC.Core.CN01.AR07
When a port is exposed, the service MUST ensure that the protocol and service officially assigned to that port number by the IANA Service Name and Transport Protocol Port Number Registry, and no other, is run on that port.
Verify HTTPS uses IANA-assigned port 443
220
CCC.Core
CCC.Core.CN01.AR08
When a service transmits data using TLS, mutual TLS (mTLS) MUST be implemented to require both client and server certificate authentication for all connections.
Verify mTLS requires client certificate authentication
202
CCC.Core
CCC.Core.CN02.AR01
When data is stored, it MUST be encrypted using the latest industry-standard encryption methods.
Verify objects are encrypted at rest
220
CCC.Core
CCC.Core.CN03.AR01
When an entity attempts to modify the service through a user interface, the authentication process MUST require multiple identifying factors for authentication.
MFA requirement for destructive operations cannot be tested automatically - NotTestable
220
CCC.Core
CCC.Core.CN04.AR01
When administrative access or configuration change is attempted on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.
Verify admin actions are logged with identity and timestamp
202
CCC.Core
CCC.Core.CN04.AR02
When any attempt is made to modify data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.
Verify data modifications are logged with identity and timestamp
202
CCC.Core
CCC.Core.CN04.AR03
When any attempt is made to read data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.
Verify data read operations are logged with identity and timestamp
202
CCC.Core
CCC.Core.CN05.AR01
When an attempt is made to modify data on the service or a child resource, the service MUST block requests from unauthorized entities.
Service allows data modification by user with write access
202
Service prevents data modification by user with no access
220
CCC.Core
CCC.Core.CN05.AR02
When administrative access or configuration change is attempted on the service or a child resource, the service MUST refuse requests from unauthorized entities.
Service allows administrative action (creating a new bucket) by user with admin access
202
Service prevents administrative action (creating a new bucket) by user with no access
220
Service prevents administrative action (creating a new bucket) by user with read-only access
220
CCC.Core
CCC.Core.CN05.AR06
When any request is made to the service or a child resource, the service MUST refuse requests from unauthorized entities.
Service prevents data read by user with no access
220
CCC.Core
CCC.Core.CN06.AR02
When a child resource is deployed, its region and availability zone MUST be included in a list of explicitly trusted or approved locations within the trust perimeter.
Child resource region compliance - NotTestable
220
CCC.Core
CCC.Core.CN07.AR01
When enumeration activities are detected, the service MUST publish an event to a monitored channel which includes the client identity, time, and nature of the activity.
Enumeration event publishing cannot be tested automatically - NotTestable
220
CCC.Core
CCC.Core.CN07.AR02
When enumeration activities are detected, the service MUST log the client identity, time, and nature of the activity.
Enumeration logging cannot be verified automatically - NotTestable
220
CCC.Core
CCC.Core.CN08.AR01
When data is created or modified, the data MUST have a complete and recoverable duplicate that is stored in a physically separate data center.
Bucket data is replicated to physically separate locations
202
CCC.Core
CCC.Core.CN08.AR02
When data is replicated into a second location, the service MUST be able to accurately represent the replication locations, replication status, and data synchronization status.
Replication status can be retrieved for monitoring
202
CCC.Core
CCC.Core.CN10.AR01
When data is replicated, the service MUST ensure that replication only occurs to destinations that are explicitly included within the defined trust perimeter.
Replication destination trust cannot be verified automatically - NotTestable
220
CCC.ObjStor
CCC.ObjStor.CN01.AR01
When a request is made to read a bucket, the service MUST prevent any request using KMS keys not listed as trusted by the organization.
Service allows reading bucket with read access
202
Service prevents reading bucket with no access
220
CCC.ObjStor
CCC.ObjStor.CN01.AR02
When a request is made to read an object, the service MUST prevent any request using KMS keys not listed as trusted by the organization.
Service allows reading object with read access
202
Service prevents reading object with no access
220
CCC.ObjStor
CCC.ObjStor.CN01.AR03
When a request is made to write to a bucket, the service MUST prevent any request using KMS keys not listed as trusted by the organization.
Service allows creating bucket with write access
202
Service prevents creating bucket with no access
220
CCC.ObjStor
CCC.ObjStor.CN01.AR04
When a request is made to write to an object, the service MUST prevent any request using KMS keys not listed as trusted by the organization.
Service allows writing object with write access
202
Service prevents writing object with read-only access
220
CCC.ObjStor
CCC.ObjStor.CN02.AR01
When a permission set is allowed for an object in a bucket, the service MUST allow the same permission set to access all objects in the same bucket.
Service enforces uniform bucket-level access by rejecting object-level permissions
202
CCC.ObjStor
CCC.ObjStor.CN02.AR02
When a permission set is denied for an object in a bucket, the service MUST deny the same permission set to access all objects in the same bucket.
Service enforces uniform bucket-level access denial
220
CCC.ObjStor
CCC.ObjStor.CN03.AR01
When an object storage bucket deletion is attempted, the bucket MUST be fully recoverable for a set time-frame after deletion is requested.
Service supports bucket soft delete and recovery
202
CCC.ObjStor
CCC.ObjStor.CN03.AR02
When an attempt is made to modify the retention policy for an object storage bucket, the service MUST prevent the policy from being modified.
Service prevents modification of locked retention policy
202
CCC.ObjStor
CCC.ObjStor.CN04.AR01
When an object is uploaded to the object storage system, the object MUST automatically receive a default retention policy that prevents premature deletion or modification.
Service applies default retention policy to newly uploaded object
202
Service enforces retention policy on newly created objects
220
Service validates retention period meets minimum requirements
220
CCC.ObjStor
CCC.ObjStor.CN04.AR02
When an attempt is made to delete or modify an object that is subject to an active retention policy, the service MUST prevent the action from being completed.
Service allows object read access during retention period
202
Service prevents object deletion by admin user during retention period
220
Service prevents object deletion by write user during retention period
202
Service prevents object modification during retention period
202
CCC.ObjStor
CCC.ObjStor.CN05.AR01
When an object is uploaded to the object storage bucket, the object MUST be stored with a unique identifier.
Service enables versioning and objects receive unique version identifiers
202
CCC.ObjStor
CCC.ObjStor.CN05.AR02
When an object is modified, the service MUST assign a new unique identifier to the modified object to differentiate it from the previous version.
Modified objects receive new version identifiers
202
CCC.ObjStor
CCC.ObjStor.CN05.AR03
When an object is modified, the service MUST allow for recovery of previous versions of the object.
Modified objects receive new version identifiers
202
CCC.ObjStor
CCC.ObjStor.CN05.AR04
When an object is deleted, the service MUST retain other versions of the object to allow for recovery of previous versions.
Deleted object data can be reloaded from previous version
220
Deleted object version remains in version list
202

Resource Summary

Summary of all resources mentioned in OCSF results

Resource NameResource TypeControl CatalogsTotal TestsPassingFailing
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
CCC.CoreCCC.ObjStor
823844
finoscccintegrationmain.blob.core.windows.net
object-storage
CCC.Core
221012

Test Results

OCSF test results filtered for entries with CCC compliance mappings

StatusFindingResource NameResource TypeMessageTest Requirements
PASS
Service accepts TLS 1.3 encrypted traffic
✓ a cloud api for "{config}" in "api" ✓ an openssl s_client request using "tls1_3" to "{port-number}" on "{host-name}" protocol "{protocol}" ✓ I refer to "{result}" as "connection" ✓ "{connection}" state is open ✓ "{connection.State}" is "open" ✓ I close connection "{connection}" ✓ "{connection}" state is closed
finoscccintegrationmain.blob.core.windows.net
object-storage
Service accepts TLS 1.3 encrypted traffic
PASS
Service rejects TLS 1.2 traffic
✓ a cloud api for "{config}" in "api" ✓ an openssl s_client request using "tls1_2" to "{port-number}" on "{host-name}" protocol "{protocol}" ✓ I refer to "{result}" as "connection" ✓ we wait for a period of "40" ms ✓ "{connection.State}" is "closed"
finoscccintegrationmain.blob.core.windows.net
object-storage
Service rejects TLS 1.2 traffic
PASS
Service rejects TLS 1.1 traffic
✓ a cloud api for "{config}" in "api" ✓ an openssl s_client request using "tls1_1" to "{port-number}" on "{host-name}" protocol "{protocol}" ✓ I refer to "{result}" as "connection" ✓ we wait for a period of "40" ms ✓ "{connection.State}" is "closed"
finoscccintegrationmain.blob.core.windows.net
object-storage
Service rejects TLS 1.1 traffic
PASS
Service rejects TLS 1.0 traffic
✓ a cloud api for "{config}" in "api" ✓ an openssl s_client request using "tls1" to "{port-number}" on "{host-name}" protocol "{protocol}" ✓ I refer to "{result}" as "connection" ✓ we wait for a period of "40" ms ✓ "{connection.State}" is "closed"
finoscccintegrationmain.blob.core.windows.net
object-storage
Service rejects TLS 1.0 traffic
FAIL
Verify SSL/TLS protocol support
✓ a cloud api for "{config}" in "api" ✗ "report" contains details of SSL Support type "protocols" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_protocols_finoscccintegrationmain.blob.core.windows.net_443.json: no such file or directory ⊘ "{report}" is an array of objects which doesn't contain any of (skipped) ⊘ "{report}" is an array of objects with at least the following contents (skipped)
finoscccintegrationmain.blob.core.windows.net
object-storage
Verify SSL/TLS protocol support
FAIL
Verify no known SSL/TLS vulnerabilities
✓ a cloud api for "{config}" in "api" ✗ "report" contains details of SSL Support type "vulnerable" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_vulnerable_finoscccintegrationmain.blob.core.windows.net_443.json: no such file or directory ⊘ "{report}" is an array of objects with at least the following contents (skipped)
finoscccintegrationmain.blob.core.windows.net
object-storage
Verify no known SSL/TLS vulnerabilities
FAIL
Verify TLS 1.3 only certificate validity
✓ a cloud api for "{config}" in "api" ✗ "report" contains details of SSL Support type "server-defaults" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_server-defaults_finoscccintegrationmain.blob.core.windows.net_443.json: no such file or directory ⊘ "{report}" is an array of objects with at least the following contents (skipped)
finoscccintegrationmain.blob.core.windows.net
object-storage
Verify TLS 1.3 only certificate validity
FAIL
HTTP redirects to HTTPS
✓ a client connects to "{host-name}" with protocol "http" on port "80" ✓ I refer to "{result}" as "connection" ✓ "{connection}" is not an error ✓ I transmit "GET / HTTP/1.1\r\nHost: {host-name}\r\n\r\n" to "{connection}" ✓ I attach "{connection}" to the test output as "HTTP response" ✗ "{connection.Output}" contains "301" - Error: expected {connection.Output} to contain '301', but got 'HTTP/1.1 400 The account being accessed does not support http. Content-Length: 288 Content-Type: application/xml Server: Microsoft-HTTPAPI/2.0 x-ms-request-id: ff4f266a-601e-0070-7ea8-fd146c000000 Date: Tue, 16 Jun 2026 15:51:51 GMT <?xml version="1.0" encoding="utf-8"?><Error><Code>AccountRequiresHttps</Code><Message>The account being accessed does not support http. RequestId:ff4f266a-601e-0070-7ea8-fd146c000000 Time:2026-06-16T15:51:52.7478485Z</Message><AccountName>finoscccintegrationmain</AccountName></Error>' ⊘ I call "{connection}" with "Close" (skipped) ⊘ "{connection.State}" is "closed" (skipped)
finoscccintegrationmain.blob.core.windows.net
object-storage
HTTP redirects to HTTPS
FAIL
Only secure protocols are exposed
✗ "report" contains details of SSL Support type "protocols" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_protocols_finoscccintegrationmain.blob.core.windows.net_443.json: no such file or directory ⊘ "{report}" is an array of objects with at least the following contents (skipped)
finoscccintegrationmain.blob.core.windows.net
object-storage
Only secure protocols are exposed
PASS
Verify HTTPS uses IANA-assigned port 443
✓ "{port-number}" is "443"
finoscccintegrationmain.blob.core.windows.net
object-storage
Verify HTTPS uses IANA-assigned port 443
FAIL
Verify mTLS requires client certificate authentication
✗ "report" contains details of SSL Support type "server-defaults" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_server-defaults_finoscccintegrationmain.blob.core.windows.net_443.json: no such file or directory ⊘ "{report}" is an array of objects with at least the following contents (skipped)
finoscccintegrationmain.blob.core.windows.net
object-storage
Verify mTLS requires client certificate authentication
PASS
Verify objects are encrypted at rest
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ "{result}" is not an error ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "test-encryption-check={timestamp}.txt", and "encryption test data" ✓ "{result}" is not an error ✓ I refer to "{result}" as "uploadResult" ✓ "{uploadResult.Encryption}" is not null ✓ "{uploadResult.EncryptionAlgorithm}" is "AES256" ✓ I attach "{uploadResult}" to the test output as "Upload Result with Encryption Details"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Verify objects are encrypted at rest
PASS
Service prevents data modification by user with no access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-no-access" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "test-cn05-unauthorized-modify={timestamp}.txt", and "unauthorized data" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "no-access-create-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents data modification by user with no access
FAIL
Service allows data modification by user with write access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-write" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "test-cn05-authorized-modify={timestamp}.txt", and "authorized data" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to upload blob test-cn05-authorized-modify=1781625054048.txt: PUT https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/test-cn05-authorized-modify=1781625054048.txt -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e63e3-601e-0070-27a7-fd146c000000 Time:2026-06-16T15:50:54.4618283Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "write-create-object-result.json" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service allows data modification by user with write access
PASS
Service prevents administrative action (creating a new bucket) by user with no access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-no-access" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateBucket" using argument "test-cn05-unauthorized-admin-container" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "no-admin-create-bucket-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents administrative action (creating a new bucket) by user with no access
PASS
Service prevents administrative action (creating a new bucket) by user with read-only access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-read" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateBucket" using argument "test-cn05-read-only-create-container" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "read-only-create-bucket-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents administrative action (creating a new bucket) by user with read-only access
FAIL
Service allows administrative action (creating a new bucket) by user with admin access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-admin" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateBucket" using argument "test-cn05-authorized-admin-container" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to create container: failed to create container test-cn05-authorized-admin-container: PUT https://finoscccintegrationmain.blob.core.windows.net/test-cn05-authorized-admin-container -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation. ERROR CODE: AuthorizationFailure -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation. RequestId:ff4e6638-601e-0070-17a7-fd146c000000 Time:2026-06-16T15:50:55.3823605Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "admin-create-bucket-result.json" (skipped) ⊘ I call "{storage}" with "DeleteBucket" using argument "test-cn05-authorized-admin-container" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service allows administrative action (creating a new bucket) by user with admin access
PASS
Child resource region compliance - NotTestable
✓ a cloud api for "{config}" in "api" ✓ no-op required
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Child resource region compliance - NotTestable
FAIL
Bucket data is replicated to physically separate locations
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "GetReplicationStatus" using argument "{resource-name}" ✓ I refer to "{result}" as "replicationStatus" ✓ I refer to "{replicationStatus.Locations}" as "locations" ✓ I attach "{replicationStatus}" to the test output as "Replication Status" ✗ "{locations}" is an array of objects with length "2" - Error: expected length 2, got 1 ⊘ "{permitted-regions}" is an array of objects with at least the following contents (skipped) ⊘ "{permitted-regions}" is an array of objects with at least the following contents (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Bucket data is replicated to physically separate locations
FAIL
Replication status can be retrieved for monitoring
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "GetReplicationStatus" using argument "{resource-name}" ✓ I refer to "{result}" as "replicationStatus" ✓ I attach "{replicationStatus}" to the test output as "Replication Status" ✓ I refer to "{replicationStatus.Locations}" as "locations" ✗ "{locations}" is an array of objects with at least the following contents - Error: expected row not found: map[value:{replication-locations[0]}]
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Replication status can be retrieved for monitoring
PASS
Service prevents reading bucket with no access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-no-access" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "ListObjects" using argument "{resource-name}" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "no-access-list-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents reading bucket with no access
FAIL
Service allows reading bucket with read access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-read" ✓ "{result}" is not an error ✓ I attach "{result}" to the test output as "read-storage-service.json" ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "ListObjects" using argument "{resource-name}" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to list blobs: GET https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e68ba-601e-0070-5ea7-fd146c000000 Time:2026-06-16T15:50:56.1181795Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "read-list-objects-result.json" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service allows reading bucket with read access
PASS
Service prevents reading object with no access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "test-object={timestamp}.txt", and "test content" ✓ "{result}" is not an error ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-no-access" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "ReadObject" using arguments "{resource-name}" and "test-object={timestamp}.txt" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "no-access-read-object-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents reading object with no access
FAIL
Service allows reading object with read access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "test-object={timestamp}.txt", and "test content" ✓ "{result}" is not an error ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-read" ✓ "{result}" is not an error ✓ I attach "{result}" to the test output as "read-storage-service.json" ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "ReadObject" using arguments "{resource-name}" and "test-object={timestamp}.txt" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to download blob test-object=1781625056691.txt: GET https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/test-object=1781625056691.txt -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e6bed-601e-0070-0aa7-fd146c000000 Time:2026-06-16T15:50:57.1956291Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "read-read-object-result.json" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service allows reading object with read access
PASS
Service prevents creating bucket with no access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-no-access" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateBucket" using argument "test-bucket-no-access" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "no-access-create-bucket-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents creating bucket with no access
FAIL
Service allows creating bucket with write access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-write" ✓ "{result}" is not an error ✓ I attach "{result}" to the test output as "write-storage-service.json" ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateBucket" using argument "test-bucket-write" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to create container: failed to create container test-bucket-write: PUT https://finoscccintegrationmain.blob.core.windows.net/test-bucket-write -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation. ERROR CODE: AuthorizationFailure -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation. RequestId:ff4e6c88-601e-0070-18a7-fd146c000000 Time:2026-06-16T15:50:57.3471600Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "write-create-bucket-result.json" (skipped) ⊘ I call "{storage}" with "DeleteBucket" using argument "{result.ID}" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service allows creating bucket with write access
PASS
Service prevents writing object with read-only access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ "{result}" is not an error ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-read" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "test-write-object={timestamp}.txt", and "test content" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "read-create-object-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents writing object with read-only access
FAIL
Service allows writing object with write access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ "{result}" is not an error ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-write" ✓ "{result}" is not an error ✓ I attach "{result}" to the test output as "write-storage-service.json" ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "test-write-object={timestamp}.txt", and "test content" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to upload blob test-write-object=1781625057458.txt: PUT https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/test-write-object=1781625057458.txt -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e6d1d-601e-0070-1ca7-fd146c000000 Time:2026-06-16T15:50:57.4988273Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "write-create-object-result.json" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service allows writing object with write access
FAIL
Service enforces uniform bucket-level access by rejecting object-level permissions
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "test-object={timestamp}.txt", and "test data" ✓ "{result}" is not an error ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-read" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "ReadObject" using arguments "{resource-name}" and "test-object={timestamp}.txt" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to download blob test-object=1781625057536.txt: GET https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/test-object=1781625057536.txt -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e6f01-601e-0070-40a7-fd146c000000 Time:2026-06-16T15:50:58.0336434Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I call "{storage}" with "SetObjectPermission" using arguments "{resource-name}", "test-object={timestamp}.txt", and "none" (skipped) ⊘ "{result}" is an error (skipped) ⊘ I attach "{result}" to the test output as "set-object-permission-error.txt" (skipped) ⊘ I call "{userStorage}" with "ReadObject" using arguments "{resource-name}" and "test-object={timestamp}.txt" (skipped) ⊘ "{result}" is not an error (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service enforces uniform bucket-level access by rejecting object-level permissions
PASS
Service enforces uniform bucket-level access denial
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "test-object={timestamp}.txt", and "test data" ✓ "{result}" is not an error ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-no-access" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "ReadObject" using arguments "{resource-name}" and "test-object={timestamp}.txt" ✓ "{result}" is an error ✓ I call "{storage}" with "SetObjectPermission" using arguments "{resource-name}", "test-object={timestamp}.txt", and "read" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "set-object-permission-error.txt" ✓ I call "{userStorage}" with "ReadObject" using arguments "{resource-name}" and "test-object={timestamp}.txt" ✓ "{result}" is an error
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service enforces uniform bucket-level access denial
FAIL
Service supports bucket soft delete and recovery
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateBucket" using argument "ccc-test-soft-delete" ✓ "{result}" is not an error ✓ I refer to "{result}" as "testBucket" ✓ I attach "{result}" to the test output as "created-bucket.json" ✓ I call "{storage}" with "DeleteBucket" using argument "ccc-test-soft-delete" ✓ "{result}" is not an error ✓ I call "{storage}" with "ListDeletedBuckets" ✓ "{result}" is not an error ✓ I attach "{result}" to the test output as "deleted-buckets.json" ✗ "{result}" is an array of objects with length "1" - Error: expected length 1, got 0 ⊘ I call "{storage}" with "RestoreBucket" using argument "ccc-test-soft-delete" (skipped) ⊘ "{result}" is not an error (skipped) ⊘ I call "{storage}" with "ListBuckets" (skipped) ⊘ "{result}" is not an error (skipped) ⊘ I attach "{result}" to the test output as "restored-buckets.json" (skipped) ⊘ I call "{storage}" with "DeleteBucket" using argument "ccc-test-soft-delete" (skipped) ⊘ "{result}" is not an error (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service supports bucket soft delete and recovery
FAIL
Service prevents modification of locked retention policy
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "GetBucketRetentionDurationDays" using argument "{resource-name}" ✓ "{result}" is not an error ✓ I refer to "{result}" as "originalRetention" ✓ I attach "{result}" to the test output as "original-retention-days.txt" ✓ "{result}" should be greater than "0" ✓ I call "{storage}" with "SetBucketRetentionDurationDays" using arguments "{resource-name}" and "1" ✗ "{result}" is an error - Error: expected {result} to be an error, got <nil> ⊘ I attach "{result}" to the test output as "set-retention-error.txt" (skipped) ⊘ I call "{storage}" with "GetBucketRetentionDurationDays" using argument "{resource-name}" (skipped) ⊘ "{result}" is not an error (skipped) ⊘ "{result}" should be greater than "0" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents modification of locked retention policy
FAIL
Service applies default retention policy to newly uploaded object
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-write" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "test-retention-object={timestamp}.txt", and "protected data" ✓ I attach "{result}" to the test output as "uploaded-object.json" ✓ I call "{userStorage}" with "GetObjectRetentionDurationDays" using arguments "{resource-name}" and "test-retention-object={timestamp}.txt" ✗ "{result}" should be greater than "1" - Error: cannot parse {result} as number: strconv.ParseFloat: parsing "failed to get blob properties: HEAD https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/test-retention-object=1781625061510.txt\n--------------------------------------------------------------------------------\nRESPONSE 403: 403 This request is not authorized to perform this operation using this permission.\nERROR CODE: AuthorizationPermissionMismatch\n--------------------------------------------------------------------------------\nResponse contained no body\n--------------------------------------------------------------------------------\n": invalid syntax
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service applies default retention policy to newly uploaded object
PASS
Service enforces retention policy on newly created objects
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "immediate-delete-test={timestamp}.txt", and "test content" ✓ "{result}" is not an error ✓ I call "{storage}" with "DeleteObject" using arguments "{resource-name}" and "immediate-delete-test={timestamp}.txt" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "immediate-delete-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service enforces retention policy on newly created objects
PASS
Service validates retention period meets minimum requirements
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "retention-period-test={timestamp}.txt", and "compliance data" ✓ I call "{storage}" with "GetObjectRetentionDurationDays" using arguments "{resource-name}" and "retention-period-test={timestamp}.txt" ✓ "{result}" should be greater than "1" ✓ I attach "{result}" to the test output as "retention-period-days.json"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service validates retention period meets minimum requirements
FAIL
Service prevents object deletion by write user during retention period
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-write" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "protected-object={timestamp}.txt", and "immutable data" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to upload blob protected-object=1781625063935.txt: PUT https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/protected-object=1781625063935.txt -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e8119-601e-0070-7aa7-fd146c000000 Time:2026-06-16T15:51:03.9766456Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "protected-object.json" (skipped) ⊘ I call "{userStorage}" with "DeleteObject" using arguments "{resource-name}" and "protected-object={timestamp}.txt" (skipped) ⊘ "{result}" is an error (skipped) ⊘ I attach "{result}" to the test output as "delete-protected-error.txt" (skipped) ? "{result}" should contain one of "retention, locked, immutable, protected" (undefined)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents object deletion by write user during retention period
PASS
Service prevents object deletion by admin user during retention period
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "admin-protected-object={timestamp}.txt", and "compliance data" ✓ "{result}" is not an error ✓ I call "{storage}" with "DeleteObject" using arguments "{resource-name}" and "admin-protected-object={timestamp}.txt" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "admin-delete-protected-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents object deletion by admin user during retention period
FAIL
Service prevents object modification during retention period
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-write" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "modify-test-object={timestamp}.txt", and "original content" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to upload blob modify-test-object=1781625064923.txt: PUT https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/modify-test-object=1781625064923.txt -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e847b-601e-0070-60a7-fd146c000000 Time:2026-06-16T15:51:04.9622031Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "original-object.json" (skipped) ⊘ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "modify-test-object={timestamp}.txt", and "modified content" (skipped) ⊘ "{result}" is an error (skipped) ⊘ I attach "{result}" to the test output as "modify-protected-error.txt" (skipped) ? "{result}" should contain one of "retention, locked, immutable, protected, exists" (undefined)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents object modification during retention period
FAIL
Service allows object read access during retention period
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "readable-protected-object={timestamp}.txt", and "readable data" ✓ "{result}" is not an error ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-read" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "ReadObject" using arguments "{resource-name}" and "readable-protected-object={timestamp}.txt" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to download blob readable-protected-object=1781625064997.txt: GET https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/readable-protected-object=1781625064997.txt -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e8604-601e-0070-29a7-fd146c000000 Time:2026-06-16T15:51:05.4938957Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I refer to "{result}" as "readResult" (skipped) ⊘ I attach "{result}" to the test output as "read-protected-object.json" (skipped) ⊘ "{readResult.Name}" is "readable-protected-object={timestamp}.txt" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service allows object read access during retention period
FAIL
Service enables versioning and objects receive unique version identifiers
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "IsBucketVersioningEnabled" using argument "{resource-name}" ✓ "{result}" is true ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "versioned-object.txt", and "test content" ✓ I refer to "{result}" as "createdObject" ? "{createdObject.VersionID}" is not empty (undefined) ⊘ I attach "{result}" to the test output as "versioned-object.json" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service enables versioning and objects receive unique version identifiers
FAIL
Modified objects receive new version identifiers
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "version-test-object={timestamp}.txt", and "original content" ✓ I refer to "{result.VersionID}" as "version1" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "version-test-object={timestamp}.txt", and "modified content" ✓ I refer to "{result.VersionID}" as "version2" ? "{version1}" is not equal to "{version2}" (undefined)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Modified objects receive new version identifiers
FAIL
Modified objects receive new version identifiers
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "version-test-object={timestamp}.txt", and "original content" ✓ I refer to "{result.VersionID}" as "version1" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "version-test-object={timestamp}.txt", and "modified content" ✓ I refer to "{result.VersionID}" as "version2" ✓ I call "{storage}" with "ReadObjectAtVersion" using arguments "{resource-name}", "version-test-object={timestamp}.txt", and "{version1}" ✓ I attach "{result}" to the test output as "original-content.json" ✓ "{result.Data}" contains "original content" ✓ I call "{storage}" with "ReadObjectAtVersion" using arguments "{resource-name}", "version-test-object={timestamp}.txt", and "{version2}" ✗ "{result.Data}" contains "modified content" - Error: expected {result.Data} to contain 'modified content', but got '[original content]' ⊘ I attach "{result}" to the test output as "modified-content.json" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Modified objects receive new version identifiers
PASS
Deleted object data can be reloaded from previous version
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "recover-deleted-object={timestamp}.txt", and "data to retain" ✓ I refer to "{result.VersionID}" as "retainedVersionId" ✓ I call "{storage}" with "DeleteObject" using arguments "{resource-name}" and "recover-deleted-object={timestamp}.txt" ✓ I call "{storage}" with "ReadObjectAtVersion" using arguments "{resource-name}", "recover-deleted-object={timestamp}.txt", and "{retainedVersionId}" ✓ "{result.Data}" contains "data to retain" ✓ I attach "{result}" to the test output as "recovered-deleted-version.json"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Deleted object data can be reloaded from previous version
FAIL
Deleted object version remains in version list
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "list-deleted-versions-object={timestamp}.txt", and "versioned data" ✓ I refer to "{result.VersionID}" as "listedVersionId" ✓ I call "{storage}" with "DeleteObject" using arguments "{resource-name}" and "list-deleted-versions-object={timestamp}.txt" ✓ I call "{storage}" with "ListObjectVersions" using arguments "{resource-name}" and "list-deleted-versions-object={timestamp}.txt" ✗ "{result}" is an array of objects with at least the following contents - Error: expected row not found: map[ObjectID:list-deleted-versions-object={timestamp}.txt VersionID:{listedVersionId}] ⊘ I attach "{result}" to the test output as "versions-after-delete.json" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Deleted object version remains in version list
PASS
MFA requirement for destructive operations cannot be tested automatically - NotTestable
✓ a cloud api for "{config}" in "api" ✓ no-op required
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
MFA requirement for destructive operations cannot be tested automatically - NotTestable
FAIL
Verify admin actions are logged with identity and timestamp
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "{service-type}" ✓ I refer to "{result}" as "theService" ✓ I call "{api}" with "GetServiceAPI" using argument "logging" ✓ I refer to "{result}" as "loggingService" ✓ I call "{theService}" with "UpdateResourcePolicy" ✓ "{result}" is not an error ✓ I attach "{result}" to the test output as "Policy Update Result" ✓ we wait for a period of "10000" ms ✓ I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "admin", and "{20}" ✓ "{result}" is not an error ✓ I refer to "{result}" as "adminLogs" ✓ I attach "{adminLogs}" to the test output as "Admin Activity Logs" ✗ "{adminLogs}" is an array of objects with at least the following contents - Error: expected row not found: map[result:Succeeded]
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Verify admin actions are logged with identity and timestamp
FAIL
Verify data modifications are logged with identity and timestamp
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "{service-type}" ✓ I refer to "{result}" as "theService" ✓ I call "{api}" with "GetServiceAPI" using argument "logging" ✓ I refer to "{result}" as "loggingService" ✓ I call "{theService}" with "TriggerDataWrite" using argument "{resource-name}" ✓ I attach "{result}" to the test output as "Data Write Trigger Result" ✓ we wait for a period of "10000" ms ✓ I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "data-write", and "{20}" ✓ I refer to "{result}" as "dataLogs" ✓ I attach "{dataLogs}" to the test output as "Data Write Logs" ✗ "{dataLogs}" is an array of objects with at least the following contents - Error: expected row not found: map[result:Succeeded]
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Verify data modifications are logged with identity and timestamp
FAIL
Verify data read operations are logged with identity and timestamp
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "{service-type}" ✓ I refer to "{result}" as "theService" ✓ I call "{api}" with "GetServiceAPI" using argument "logging" ✓ I refer to "{result}" as "loggingService" ✓ I call "{theService}" with "TriggerDataRead" using argument "{resource-name}" ✓ I attach "{result}" to the test output as "Data Read Trigger Result" ✓ we wait for a period of "10000" ms ✓ I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "data-read", and "{20}" ✓ "{result}" is not an error ✓ I refer to "{result}" as "readLogs" ✓ I attach "{readLogs}" to the test output as "Data Read Logs" ✗ "{readLogs}" is an array of objects with at least the following contents - Error: expected row not found: map[result:Succeeded]
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Verify data read operations are logged with identity and timestamp
PASS
Service prevents data read by user with no access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "{service-type}" and "test-user-no-access" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userReadableService" ✓ I call "{userReadableService}" with "TriggerDataRead" using argument "{resource-name}" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "no-access-trigger-data-read-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents data read by user with no access
PASS
Enumeration event publishing cannot be tested automatically - NotTestable
✓ a cloud api for "{config}" in "api" ✓ no-op required
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Enumeration event publishing cannot be tested automatically - NotTestable
PASS
Enumeration logging cannot be verified automatically - NotTestable
✓ a cloud api for "{config}" in "api" ✓ no-op required
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Enumeration logging cannot be verified automatically - NotTestable
PASS
Replication destination trust cannot be verified automatically - NotTestable
✓ a cloud api for "{config}" in "api" ✓ no-op required
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Replication destination trust cannot be verified automatically - NotTestable
PASS
Service accepts TLS 1.3 encrypted traffic
✓ a cloud api for "{config}" in "api" ✓ an openssl s_client request using "tls1_3" to "{port-number}" on "{host-name}" protocol "{protocol}" ✓ I refer to "{result}" as "connection" ✓ "{connection}" state is open ✓ "{connection.State}" is "open" ✓ I close connection "{connection}" ✓ "{connection}" state is closed
finoscccintegrationmain.blob.core.windows.net
object-storage
Service accepts TLS 1.3 encrypted traffic
PASS
Service rejects TLS 1.2 traffic
✓ a cloud api for "{config}" in "api" ✓ an openssl s_client request using "tls1_2" to "{port-number}" on "{host-name}" protocol "{protocol}" ✓ I refer to "{result}" as "connection" ✓ we wait for a period of "40" ms ✓ "{connection.State}" is "closed"
finoscccintegrationmain.blob.core.windows.net
object-storage
Service rejects TLS 1.2 traffic
PASS
Service rejects TLS 1.1 traffic
✓ a cloud api for "{config}" in "api" ✓ an openssl s_client request using "tls1_1" to "{port-number}" on "{host-name}" protocol "{protocol}" ✓ I refer to "{result}" as "connection" ✓ we wait for a period of "40" ms ✓ "{connection.State}" is "closed"
finoscccintegrationmain.blob.core.windows.net
object-storage
Service rejects TLS 1.1 traffic
PASS
Service rejects TLS 1.0 traffic
✓ a cloud api for "{config}" in "api" ✓ an openssl s_client request using "tls1" to "{port-number}" on "{host-name}" protocol "{protocol}" ✓ I refer to "{result}" as "connection" ✓ we wait for a period of "40" ms ✓ "{connection.State}" is "closed"
finoscccintegrationmain.blob.core.windows.net
object-storage
Service rejects TLS 1.0 traffic
FAIL
Verify SSL/TLS protocol support
✓ a cloud api for "{config}" in "api" ✗ "report" contains details of SSL Support type "protocols" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_protocols_finoscccintegrationmain.blob.core.windows.net_443.json: no such file or directory ⊘ "{report}" is an array of objects which doesn't contain any of (skipped) ⊘ "{report}" is an array of objects with at least the following contents (skipped)
finoscccintegrationmain.blob.core.windows.net
object-storage
Verify SSL/TLS protocol support
FAIL
Verify no known SSL/TLS vulnerabilities
✓ a cloud api for "{config}" in "api" ✗ "report" contains details of SSL Support type "vulnerable" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_vulnerable_finoscccintegrationmain.blob.core.windows.net_443.json: no such file or directory ⊘ "{report}" is an array of objects with at least the following contents (skipped)
finoscccintegrationmain.blob.core.windows.net
object-storage
Verify no known SSL/TLS vulnerabilities
FAIL
Verify TLS 1.3 only certificate validity
✓ a cloud api for "{config}" in "api" ✗ "report" contains details of SSL Support type "server-defaults" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_server-defaults_finoscccintegrationmain.blob.core.windows.net_443.json: no such file or directory ⊘ "{report}" is an array of objects with at least the following contents (skipped)
finoscccintegrationmain.blob.core.windows.net
object-storage
Verify TLS 1.3 only certificate validity
FAIL
HTTP redirects to HTTPS
✓ a client connects to "{host-name}" with protocol "http" on port "80" ✓ I refer to "{result}" as "connection" ✓ "{connection}" is not an error ✓ I transmit "GET / HTTP/1.1\r\nHost: {host-name}\r\n\r\n" to "{connection}" ✓ I attach "{connection}" to the test output as "HTTP response" ✗ "{connection.Output}" contains "301" - Error: expected {connection.Output} to contain '301', but got 'HTTP/1.1 400 The account being accessed does not support http. Content-Length: 288 Content-Type: application/xml Server: Microsoft-HTTPAPI/2.0 x-ms-request-id: ff4f266a-601e-0070-7ea8-fd146c000000 Date: Tue, 16 Jun 2026 15:51:51 GMT <?xml version="1.0" encoding="utf-8"?><Error><Code>AccountRequiresHttps</Code><Message>The account being accessed does not support http. RequestId:ff4f266a-601e-0070-7ea8-fd146c000000 Time:2026-06-16T15:51:52.7478485Z</Message><AccountName>finoscccintegrationmain</AccountName></Error>' ⊘ I call "{connection}" with "Close" (skipped) ⊘ "{connection.State}" is "closed" (skipped)
finoscccintegrationmain.blob.core.windows.net
object-storage
HTTP redirects to HTTPS
FAIL
Only secure protocols are exposed
✗ "report" contains details of SSL Support type "protocols" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_protocols_finoscccintegrationmain.blob.core.windows.net_443.json: no such file or directory ⊘ "{report}" is an array of objects with at least the following contents (skipped)
finoscccintegrationmain.blob.core.windows.net
object-storage
Only secure protocols are exposed
PASS
Verify HTTPS uses IANA-assigned port 443
✓ "{port-number}" is "443"
finoscccintegrationmain.blob.core.windows.net
object-storage
Verify HTTPS uses IANA-assigned port 443
FAIL
Verify mTLS requires client certificate authentication
✗ "report" contains details of SSL Support type "server-defaults" for "{host-name}" on port "{port-number}" - Error: failed to read testssl.sh output: open /tmp/testssl_server-defaults_finoscccintegrationmain.blob.core.windows.net_443.json: no such file or directory ⊘ "{report}" is an array of objects with at least the following contents (skipped)
finoscccintegrationmain.blob.core.windows.net
object-storage
Verify mTLS requires client certificate authentication
PASS
Verify objects are encrypted at rest
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ "{result}" is not an error ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "test-encryption-check={timestamp}.txt", and "encryption test data" ✓ "{result}" is not an error ✓ I refer to "{result}" as "uploadResult" ✓ "{uploadResult.Encryption}" is not null ✓ "{uploadResult.EncryptionAlgorithm}" is "AES256" ✓ I attach "{uploadResult}" to the test output as "Upload Result with Encryption Details"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Verify objects are encrypted at rest
PASS
Service prevents data modification by user with no access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-no-access" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "test-cn05-unauthorized-modify={timestamp}.txt", and "unauthorized data" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "no-access-create-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents data modification by user with no access
FAIL
Service allows data modification by user with write access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-write" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "test-cn05-authorized-modify={timestamp}.txt", and "authorized data" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to upload blob test-cn05-authorized-modify=1781625054048.txt: PUT https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/test-cn05-authorized-modify=1781625054048.txt -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e63e3-601e-0070-27a7-fd146c000000 Time:2026-06-16T15:50:54.4618283Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "write-create-object-result.json" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service allows data modification by user with write access
PASS
Service prevents administrative action (creating a new bucket) by user with no access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-no-access" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateBucket" using argument "test-cn05-unauthorized-admin-container" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "no-admin-create-bucket-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents administrative action (creating a new bucket) by user with no access
PASS
Service prevents administrative action (creating a new bucket) by user with read-only access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-read" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateBucket" using argument "test-cn05-read-only-create-container" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "read-only-create-bucket-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents administrative action (creating a new bucket) by user with read-only access
FAIL
Service allows administrative action (creating a new bucket) by user with admin access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-admin" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateBucket" using argument "test-cn05-authorized-admin-container" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to create container: failed to create container test-cn05-authorized-admin-container: PUT https://finoscccintegrationmain.blob.core.windows.net/test-cn05-authorized-admin-container -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation. ERROR CODE: AuthorizationFailure -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation. RequestId:ff4e6638-601e-0070-17a7-fd146c000000 Time:2026-06-16T15:50:55.3823605Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "admin-create-bucket-result.json" (skipped) ⊘ I call "{storage}" with "DeleteBucket" using argument "test-cn05-authorized-admin-container" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service allows administrative action (creating a new bucket) by user with admin access
PASS
Child resource region compliance - NotTestable
✓ a cloud api for "{config}" in "api" ✓ no-op required
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Child resource region compliance - NotTestable
FAIL
Bucket data is replicated to physically separate locations
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "GetReplicationStatus" using argument "{resource-name}" ✓ I refer to "{result}" as "replicationStatus" ✓ I refer to "{replicationStatus.Locations}" as "locations" ✓ I attach "{replicationStatus}" to the test output as "Replication Status" ✗ "{locations}" is an array of objects with length "2" - Error: expected length 2, got 1 ⊘ "{permitted-regions}" is an array of objects with at least the following contents (skipped) ⊘ "{permitted-regions}" is an array of objects with at least the following contents (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Bucket data is replicated to physically separate locations
FAIL
Replication status can be retrieved for monitoring
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "GetReplicationStatus" using argument "{resource-name}" ✓ I refer to "{result}" as "replicationStatus" ✓ I attach "{replicationStatus}" to the test output as "Replication Status" ✓ I refer to "{replicationStatus.Locations}" as "locations" ✗ "{locations}" is an array of objects with at least the following contents - Error: expected row not found: map[value:{replication-locations[0]}]
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Replication status can be retrieved for monitoring
PASS
Service prevents reading bucket with no access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-no-access" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "ListObjects" using argument "{resource-name}" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "no-access-list-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents reading bucket with no access
FAIL
Service allows reading bucket with read access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-read" ✓ "{result}" is not an error ✓ I attach "{result}" to the test output as "read-storage-service.json" ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "ListObjects" using argument "{resource-name}" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to list blobs: GET https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e68ba-601e-0070-5ea7-fd146c000000 Time:2026-06-16T15:50:56.1181795Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "read-list-objects-result.json" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service allows reading bucket with read access
PASS
Service prevents reading object with no access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "test-object={timestamp}.txt", and "test content" ✓ "{result}" is not an error ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-no-access" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "ReadObject" using arguments "{resource-name}" and "test-object={timestamp}.txt" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "no-access-read-object-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents reading object with no access
FAIL
Service allows reading object with read access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "test-object={timestamp}.txt", and "test content" ✓ "{result}" is not an error ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-read" ✓ "{result}" is not an error ✓ I attach "{result}" to the test output as "read-storage-service.json" ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "ReadObject" using arguments "{resource-name}" and "test-object={timestamp}.txt" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to download blob test-object=1781625056691.txt: GET https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/test-object=1781625056691.txt -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e6bed-601e-0070-0aa7-fd146c000000 Time:2026-06-16T15:50:57.1956291Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "read-read-object-result.json" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service allows reading object with read access
PASS
Service prevents creating bucket with no access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-no-access" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateBucket" using argument "test-bucket-no-access" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "no-access-create-bucket-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents creating bucket with no access
FAIL
Service allows creating bucket with write access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-write" ✓ "{result}" is not an error ✓ I attach "{result}" to the test output as "write-storage-service.json" ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateBucket" using argument "test-bucket-write" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to create container: failed to create container test-bucket-write: PUT https://finoscccintegrationmain.blob.core.windows.net/test-bucket-write -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation. ERROR CODE: AuthorizationFailure -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation. RequestId:ff4e6c88-601e-0070-18a7-fd146c000000 Time:2026-06-16T15:50:57.3471600Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "write-create-bucket-result.json" (skipped) ⊘ I call "{storage}" with "DeleteBucket" using argument "{result.ID}" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service allows creating bucket with write access
PASS
Service prevents writing object with read-only access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ "{result}" is not an error ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-read" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "test-write-object={timestamp}.txt", and "test content" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "read-create-object-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents writing object with read-only access
FAIL
Service allows writing object with write access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ "{result}" is not an error ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-write" ✓ "{result}" is not an error ✓ I attach "{result}" to the test output as "write-storage-service.json" ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "test-write-object={timestamp}.txt", and "test content" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to upload blob test-write-object=1781625057458.txt: PUT https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/test-write-object=1781625057458.txt -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e6d1d-601e-0070-1ca7-fd146c000000 Time:2026-06-16T15:50:57.4988273Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "write-create-object-result.json" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service allows writing object with write access
FAIL
Service enforces uniform bucket-level access by rejecting object-level permissions
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "test-object={timestamp}.txt", and "test data" ✓ "{result}" is not an error ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-read" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "ReadObject" using arguments "{resource-name}" and "test-object={timestamp}.txt" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to download blob test-object=1781625057536.txt: GET https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/test-object=1781625057536.txt -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e6f01-601e-0070-40a7-fd146c000000 Time:2026-06-16T15:50:58.0336434Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I call "{storage}" with "SetObjectPermission" using arguments "{resource-name}", "test-object={timestamp}.txt", and "none" (skipped) ⊘ "{result}" is an error (skipped) ⊘ I attach "{result}" to the test output as "set-object-permission-error.txt" (skipped) ⊘ I call "{userStorage}" with "ReadObject" using arguments "{resource-name}" and "test-object={timestamp}.txt" (skipped) ⊘ "{result}" is not an error (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service enforces uniform bucket-level access by rejecting object-level permissions
PASS
Service enforces uniform bucket-level access denial
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "test-object={timestamp}.txt", and "test data" ✓ "{result}" is not an error ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-no-access" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "ReadObject" using arguments "{resource-name}" and "test-object={timestamp}.txt" ✓ "{result}" is an error ✓ I call "{storage}" with "SetObjectPermission" using arguments "{resource-name}", "test-object={timestamp}.txt", and "read" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "set-object-permission-error.txt" ✓ I call "{userStorage}" with "ReadObject" using arguments "{resource-name}" and "test-object={timestamp}.txt" ✓ "{result}" is an error
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service enforces uniform bucket-level access denial
FAIL
Service supports bucket soft delete and recovery
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateBucket" using argument "ccc-test-soft-delete" ✓ "{result}" is not an error ✓ I refer to "{result}" as "testBucket" ✓ I attach "{result}" to the test output as "created-bucket.json" ✓ I call "{storage}" with "DeleteBucket" using argument "ccc-test-soft-delete" ✓ "{result}" is not an error ✓ I call "{storage}" with "ListDeletedBuckets" ✓ "{result}" is not an error ✓ I attach "{result}" to the test output as "deleted-buckets.json" ✗ "{result}" is an array of objects with length "1" - Error: expected length 1, got 0 ⊘ I call "{storage}" with "RestoreBucket" using argument "ccc-test-soft-delete" (skipped) ⊘ "{result}" is not an error (skipped) ⊘ I call "{storage}" with "ListBuckets" (skipped) ⊘ "{result}" is not an error (skipped) ⊘ I attach "{result}" to the test output as "restored-buckets.json" (skipped) ⊘ I call "{storage}" with "DeleteBucket" using argument "ccc-test-soft-delete" (skipped) ⊘ "{result}" is not an error (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service supports bucket soft delete and recovery
FAIL
Service prevents modification of locked retention policy
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "GetBucketRetentionDurationDays" using argument "{resource-name}" ✓ "{result}" is not an error ✓ I refer to "{result}" as "originalRetention" ✓ I attach "{result}" to the test output as "original-retention-days.txt" ✓ "{result}" should be greater than "0" ✓ I call "{storage}" with "SetBucketRetentionDurationDays" using arguments "{resource-name}" and "1" ✗ "{result}" is an error - Error: expected {result} to be an error, got <nil> ⊘ I attach "{result}" to the test output as "set-retention-error.txt" (skipped) ⊘ I call "{storage}" with "GetBucketRetentionDurationDays" using argument "{resource-name}" (skipped) ⊘ "{result}" is not an error (skipped) ⊘ "{result}" should be greater than "0" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents modification of locked retention policy
FAIL
Service applies default retention policy to newly uploaded object
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-write" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "test-retention-object={timestamp}.txt", and "protected data" ✓ I attach "{result}" to the test output as "uploaded-object.json" ✓ I call "{userStorage}" with "GetObjectRetentionDurationDays" using arguments "{resource-name}" and "test-retention-object={timestamp}.txt" ✗ "{result}" should be greater than "1" - Error: cannot parse {result} as number: strconv.ParseFloat: parsing "failed to get blob properties: HEAD https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/test-retention-object=1781625061510.txt\n--------------------------------------------------------------------------------\nRESPONSE 403: 403 This request is not authorized to perform this operation using this permission.\nERROR CODE: AuthorizationPermissionMismatch\n--------------------------------------------------------------------------------\nResponse contained no body\n--------------------------------------------------------------------------------\n": invalid syntax
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service applies default retention policy to newly uploaded object
PASS
Service enforces retention policy on newly created objects
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "immediate-delete-test={timestamp}.txt", and "test content" ✓ "{result}" is not an error ✓ I call "{storage}" with "DeleteObject" using arguments "{resource-name}" and "immediate-delete-test={timestamp}.txt" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "immediate-delete-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service enforces retention policy on newly created objects
PASS
Service validates retention period meets minimum requirements
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "retention-period-test={timestamp}.txt", and "compliance data" ✓ I call "{storage}" with "GetObjectRetentionDurationDays" using arguments "{resource-name}" and "retention-period-test={timestamp}.txt" ✓ "{result}" should be greater than "1" ✓ I attach "{result}" to the test output as "retention-period-days.json"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service validates retention period meets minimum requirements
FAIL
Service prevents object deletion by write user during retention period
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-write" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "protected-object={timestamp}.txt", and "immutable data" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to upload blob protected-object=1781625063935.txt: PUT https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/protected-object=1781625063935.txt -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e8119-601e-0070-7aa7-fd146c000000 Time:2026-06-16T15:51:03.9766456Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "protected-object.json" (skipped) ⊘ I call "{userStorage}" with "DeleteObject" using arguments "{resource-name}" and "protected-object={timestamp}.txt" (skipped) ⊘ "{result}" is an error (skipped) ⊘ I attach "{result}" to the test output as "delete-protected-error.txt" (skipped) ? "{result}" should contain one of "retention, locked, immutable, protected" (undefined)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents object deletion by write user during retention period
PASS
Service prevents object deletion by admin user during retention period
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "admin-protected-object={timestamp}.txt", and "compliance data" ✓ "{result}" is not an error ✓ I call "{storage}" with "DeleteObject" using arguments "{resource-name}" and "admin-protected-object={timestamp}.txt" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "admin-delete-protected-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents object deletion by admin user during retention period
FAIL
Service prevents object modification during retention period
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-write" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "modify-test-object={timestamp}.txt", and "original content" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to upload blob modify-test-object=1781625064923.txt: PUT https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/modify-test-object=1781625064923.txt -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e847b-601e-0070-60a7-fd146c000000 Time:2026-06-16T15:51:04.9622031Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I attach "{result}" to the test output as "original-object.json" (skipped) ⊘ I call "{userStorage}" with "CreateObject" using arguments "{resource-name}", "modify-test-object={timestamp}.txt", and "modified content" (skipped) ⊘ "{result}" is an error (skipped) ⊘ I attach "{result}" to the test output as "modify-protected-error.txt" (skipped) ? "{result}" should contain one of "retention, locked, immutable, protected, exists" (undefined)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents object modification during retention period
FAIL
Service allows object read access during retention period
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "readable-protected-object={timestamp}.txt", and "readable data" ✓ "{result}" is not an error ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage" and "test-user-read" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userStorage" ✓ I call "{userStorage}" with "ReadObject" using arguments "{resource-name}" and "readable-protected-object={timestamp}.txt" ✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: failed to download blob readable-protected-object=1781625064997.txt: GET https://finoscccintegrationmain.blob.core.windows.net/finos-ccc-integration-container-main/readable-protected-object=1781625064997.txt -------------------------------------------------------------------------------- RESPONSE 403: 403 This request is not authorized to perform this operation using this permission. ERROR CODE: AuthorizationPermissionMismatch -------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission. RequestId:ff4e8604-601e-0070-29a7-fd146c000000 Time:2026-06-16T15:51:05.4938957Z</Message></Error> -------------------------------------------------------------------------------- ⊘ I refer to "{result}" as "readResult" (skipped) ⊘ I attach "{result}" to the test output as "read-protected-object.json" (skipped) ⊘ "{readResult.Name}" is "readable-protected-object={timestamp}.txt" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service allows object read access during retention period
FAIL
Service enables versioning and objects receive unique version identifiers
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "IsBucketVersioningEnabled" using argument "{resource-name}" ✓ "{result}" is true ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "versioned-object.txt", and "test content" ✓ I refer to "{result}" as "createdObject" ? "{createdObject.VersionID}" is not empty (undefined) ⊘ I attach "{result}" to the test output as "versioned-object.json" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service enables versioning and objects receive unique version identifiers
FAIL
Modified objects receive new version identifiers
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "version-test-object={timestamp}.txt", and "original content" ✓ I refer to "{result.VersionID}" as "version1" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "version-test-object={timestamp}.txt", and "modified content" ✓ I refer to "{result.VersionID}" as "version2" ? "{version1}" is not equal to "{version2}" (undefined)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Modified objects receive new version identifiers
FAIL
Modified objects receive new version identifiers
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "version-test-object={timestamp}.txt", and "original content" ✓ I refer to "{result.VersionID}" as "version1" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "version-test-object={timestamp}.txt", and "modified content" ✓ I refer to "{result.VersionID}" as "version2" ✓ I call "{storage}" with "ReadObjectAtVersion" using arguments "{resource-name}", "version-test-object={timestamp}.txt", and "{version1}" ✓ I attach "{result}" to the test output as "original-content.json" ✓ "{result.Data}" contains "original content" ✓ I call "{storage}" with "ReadObjectAtVersion" using arguments "{resource-name}", "version-test-object={timestamp}.txt", and "{version2}" ✗ "{result.Data}" contains "modified content" - Error: expected {result.Data} to contain 'modified content', but got '[original content]' ⊘ I attach "{result}" to the test output as "modified-content.json" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Modified objects receive new version identifiers
PASS
Deleted object data can be reloaded from previous version
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "recover-deleted-object={timestamp}.txt", and "data to retain" ✓ I refer to "{result.VersionID}" as "retainedVersionId" ✓ I call "{storage}" with "DeleteObject" using arguments "{resource-name}" and "recover-deleted-object={timestamp}.txt" ✓ I call "{storage}" with "ReadObjectAtVersion" using arguments "{resource-name}", "recover-deleted-object={timestamp}.txt", and "{retainedVersionId}" ✓ "{result.Data}" contains "data to retain" ✓ I attach "{result}" to the test output as "recovered-deleted-version.json"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Deleted object data can be reloaded from previous version
FAIL
Deleted object version remains in version list
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "object-storage" ✓ I refer to "{result}" as "storage" ✓ I call "{storage}" with "CreateObject" using arguments "{resource-name}", "list-deleted-versions-object={timestamp}.txt", and "versioned data" ✓ I refer to "{result.VersionID}" as "listedVersionId" ✓ I call "{storage}" with "DeleteObject" using arguments "{resource-name}" and "list-deleted-versions-object={timestamp}.txt" ✓ I call "{storage}" with "ListObjectVersions" using arguments "{resource-name}" and "list-deleted-versions-object={timestamp}.txt" ✗ "{result}" is an array of objects with at least the following contents - Error: expected row not found: map[ObjectID:list-deleted-versions-object={timestamp}.txt VersionID:{listedVersionId}] ⊘ I attach "{result}" to the test output as "versions-after-delete.json" (skipped)
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Deleted object version remains in version list
PASS
MFA requirement for destructive operations cannot be tested automatically - NotTestable
✓ a cloud api for "{config}" in "api" ✓ no-op required
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
MFA requirement for destructive operations cannot be tested automatically - NotTestable
FAIL
Verify admin actions are logged with identity and timestamp
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "{service-type}" ✓ I refer to "{result}" as "theService" ✓ I call "{api}" with "GetServiceAPI" using argument "logging" ✓ I refer to "{result}" as "loggingService" ✓ I call "{theService}" with "UpdateResourcePolicy" ✓ "{result}" is not an error ✓ I attach "{result}" to the test output as "Policy Update Result" ✓ we wait for a period of "10000" ms ✓ I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "admin", and "{20}" ✓ "{result}" is not an error ✓ I refer to "{result}" as "adminLogs" ✓ I attach "{adminLogs}" to the test output as "Admin Activity Logs" ✗ "{adminLogs}" is an array of objects with at least the following contents - Error: expected row not found: map[result:Succeeded]
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Verify admin actions are logged with identity and timestamp
FAIL
Verify data modifications are logged with identity and timestamp
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "{service-type}" ✓ I refer to "{result}" as "theService" ✓ I call "{api}" with "GetServiceAPI" using argument "logging" ✓ I refer to "{result}" as "loggingService" ✓ I call "{theService}" with "TriggerDataWrite" using argument "{resource-name}" ✓ I attach "{result}" to the test output as "Data Write Trigger Result" ✓ we wait for a period of "10000" ms ✓ I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "data-write", and "{20}" ✓ I refer to "{result}" as "dataLogs" ✓ I attach "{dataLogs}" to the test output as "Data Write Logs" ✗ "{dataLogs}" is an array of objects with at least the following contents - Error: expected row not found: map[result:Succeeded]
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Verify data modifications are logged with identity and timestamp
FAIL
Verify data read operations are logged with identity and timestamp
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPI" using argument "{service-type}" ✓ I refer to "{result}" as "theService" ✓ I call "{api}" with "GetServiceAPI" using argument "logging" ✓ I refer to "{result}" as "loggingService" ✓ I call "{theService}" with "TriggerDataRead" using argument "{resource-name}" ✓ I attach "{result}" to the test output as "Data Read Trigger Result" ✓ we wait for a period of "10000" ms ✓ I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "data-read", and "{20}" ✓ "{result}" is not an error ✓ I refer to "{result}" as "readLogs" ✓ I attach "{readLogs}" to the test output as "Data Read Logs" ✗ "{readLogs}" is an array of objects with at least the following contents - Error: expected row not found: map[result:Succeeded]
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Verify data read operations are logged with identity and timestamp
PASS
Service prevents data read by user with no access
✓ a cloud api for "{config}" in "api" ✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "{service-type}" and "test-user-no-access" ✓ "{result}" is not an error ✓ I refer to "{result}" as "userReadableService" ✓ I call "{userReadableService}" with "TriggerDataRead" using argument "{resource-name}" ✓ "{result}" is an error ✓ I attach "{result}" to the test output as "no-access-trigger-data-read-error.txt"
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Service prevents data read by user with no access
PASS
Enumeration event publishing cannot be tested automatically - NotTestable
✓ a cloud api for "{config}" in "api" ✓ no-op required
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Enumeration event publishing cannot be tested automatically - NotTestable
PASS
Enumeration logging cannot be verified automatically - NotTestable
✓ a cloud api for "{config}" in "api" ✓ no-op required
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Enumeration logging cannot be verified automatically - NotTestable
PASS
Replication destination trust cannot be verified automatically - NotTestable
✓ a cloud api for "{config}" in "api" ✓ no-op required
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/finos-ccc-integration-rg/providers/Microsoft.Storage/storageAccounts/finoscccintegrationmain
object-storage
Replication destination trust cannot be verified automatically - NotTestable