CCC-Complete (Behavioural) 0.1
Test results for this specific product, vendor, and version combination
| Vendor | FINOS |
| Product | CCC-Complete (Behavioural) |
| Version | 0.1 |
Download Raw Results
Download the original OCSF or HTML result files used to generate this page
Test Summary
Aggregate summary of all tests for this configuration result
| Resources In Configuration | 2 |
| Count of Tests | 104 |
| Passing Tests | 70 |
| Failing Tests | 34 |
| Catalogs Tested |
Control Catalog Summary
Summary of test results grouped by control catalog and resource
| Control Catalog | Resources | Total Tests | Passing | Failing | Tested Requirements | Missing Requirements | Unused Core Requirements |
|---|---|---|---|---|---|---|---|
| CCC.Core | /subscriptions/c1ced...stgcfi20260410t12183... | 56 | 42 | 14 | CCC.Core.CN01.AR01CCC.Core.CN01.AR03CCC.Core.CN01.AR07CCC.Core.CN01.AR08CCC.Core.CN02.AR01CCC.Core.CN03.AR01CCC.Core.CN04.AR01CCC.Core.CN04.AR03CCC.Core.CN05.AR01CCC.Core.CN05.AR02CCC.Core.CN05.AR06CCC.Core.CN06.AR01CCC.Core.CN06.AR02CCC.Core.CN07.AR01CCC.Core.CN07.AR02CCC.Core.CN08.AR01CCC.Core.CN08.AR02CCC.Core.CN10.AR01 | ||
| CCC.ObjStor | /subscriptions/c1ced... | 48 | 28 | 20 | None |
Test Mapping Summary
Summary of test mappings showing how event codes map to test requirements
| Control Catalog | Test Requirement | Mapped Tests (Event Code | Total | Passing | Failing) |
|---|---|---|
| CCC.Core | CCC.Core.CN01.AR01 When a port is exposed for non-SSH network traffic, all traffic
MUST include a TLS handshake AND be encrypted using TLS 1.3 or
higher.
| Service accepts TLS 1.3 encrypted traffic220 Service rejects TLS 1.0 traffic220 Service rejects TLS 1.1 traffic220 Service rejects TLS 1.2 traffic220 Verify no known SSL/TLS vulnerabilities220 Verify SSL/TLS protocol support202 Verify TLS 1.3 only certificate validity220 |
| CCC.Core | CCC.Core.CN01.AR03 When the service receives unencrypted traffic,
then it MUST either block the request or automatically
redirect it to the secure equivalent.
| HTTP redirects to HTTPS202 Only secure protocols are exposed220 |
| CCC.Core | CCC.Core.CN01.AR07 When a port is exposed, the service MUST ensure that the protocol
and service officially assigned to that port number by the IANA
Service Name and Transport Protocol Port Number Registry, and no
other, is run on that port.
| Verify HTTPS uses IANA-assigned port 443220 |
| CCC.Core | CCC.Core.CN01.AR08 When a service transmits data using TLS, mutual TLS (mTLS) MUST be
implemented to require both client and server certificate
authentication for all connections.
| Verify mTLS requires client certificate authentication202 |
| CCC.Core | CCC.Core.CN02.AR01 When data is stored, it MUST be encrypted using the latest
industry-standard encryption methods.
| Verify objects are encrypted at rest220 |
| CCC.Core | CCC.Core.CN03.AR01 When an entity attempts to modify the service through a user
interface, the authentication process MUST require multiple
identifying factors for authentication.
| MFA requirement for destructive operations cannot be tested automatically220 |
| CCC.Core | CCC.Core.CN04.AR01 When administrative access or configuration change is attempted on
the service or a child resource, the service MUST log the client
identity, time, and result of the attempt.
| Verify admin actions are logged with identity and timestamp220 |
| CCC.Core | CCC.Core.CN04.AR03 When any attempt is made to read data on the service or a child
resource, the service MUST log the client identity, time, and
result of the attempt.
| Verify data read operations are logged with identity and timestamp202 |
| CCC.Core | CCC.Core.CN05.AR01 When an attempt is made to modify data on the service or a child
resource, the service MUST block requests from unauthorized
entities.
| Service allows data modification by user with write access220 Service prevents data modification by user with no access202 |
| CCC.Core | CCC.Core.CN05.AR02 When administrative access or configuration change is attempted on
the service or a child resource, the service MUST refuse requests
from unauthorized entities.
| Service allows administrative action (creating a new bucket) by user with admin access202 Service prevents administrative action (creating a new bucket) by user with no access220 Service prevents administrative action (creating a new bucket) by user with read-only access220 |
| CCC.Core | CCC.Core.CN05.AR06 When any request is made to the service or a child resource, the
service MUST refuse requests from unauthorized entities.
| Service prevents data read by user with no access - Duplicate220 |
| CCC.Core | CCC.Core.CN06.AR01 When the service is running, its region and availability zone MUST
be included in a list of explicitly trusted or approved locations
within the trust perimeter.
| Resource region can be retrieved for compliance verification202 |
| CCC.Core | CCC.Core.CN06.AR02 When a child resource is deployed, its region and availability
zone MUST be included in a list of explicitly trusted or approved
locations within the trust perimeter.
| Child resource region compliance - NotTestable220 |
| CCC.Core | CCC.Core.CN07.AR01 When enumeration activities are detected, the service MUST publish
an event to a monitored channel which includes the client
identity, time, and nature of the activity.
| Enumeration event publishing cannot be tested automatically - NotTestable220 |
| CCC.Core | CCC.Core.CN07.AR02 When enumeration activities are detected, the service MUST log the
client identity, time, and nature of the activity.
| Enumeration logging cannot be verified automatically - NotTestable220 |
| CCC.Core | CCC.Core.CN08.AR01 When data is created or modified, the data MUST have a complete
and recoverable duplicate that is stored in a physically separate
data center.
| Bucket data is replicated to physically separate locations220 |
| CCC.Core | CCC.Core.CN08.AR02 When data is replicated into a second location, the service MUST
be able to accurately represent the replication locations,
replication status, and data synchronization status.
| Replication status can be retrieved for monitoring220 |
| CCC.Core | CCC.Core.CN10.AR01 When data is replicated, the service MUST ensure that replication
only occurs to destinations that are explicitly included within
the defined trust perimeter.
| Replication destination trust cannot be verified automatically - NotTestable220 |
| CCC.ObjStor | CCC.ObjStor.CN01.AR01 When a request is made to read a bucket, the service
MUST prevent any request using KMS keys not listed as trusted by
the organization.
| Service allows reading bucket with read access220 Service prevents reading bucket with no access220 |
| CCC.ObjStor | CCC.ObjStor.CN01.AR02 When a request is made to read an object, the service
MUST prevent any request using KMS keys not listed as trusted by
the organization.
| Service allows reading object with read access220 Service prevents reading object with no access220 |
| CCC.ObjStor | CCC.ObjStor.CN01.AR03 When a request is made to write to a bucket, the service MUST
prevent any request using KMS keys not listed as trusted by the
organization.
| Service allows creating bucket with write access202 Service prevents creating bucket with no access220 |
| CCC.ObjStor | CCC.ObjStor.CN01.AR04 When a request is made to write to an object, the service MUST
prevent any request using KMS keys not listed as trusted by the
organization.
| Service allows writing object with write access220 Service prevents writing object with read-only access220 |
| CCC.ObjStor | CCC.ObjStor.CN02.AR01 When a permission set is allowed for an object in a bucket, the
service MUST allow the same permission set to access all objects
in the same bucket.
| Service enforces uniform bucket-level access by rejecting object-level permissions220 |
| CCC.ObjStor | CCC.ObjStor.CN02.AR02 When a permission set is denied for an object in a bucket, the
service MUST deny the same permission set to access all objects
in the same bucket.
| Service enforces uniform bucket-level access denial220 |
| CCC.ObjStor | CCC.ObjStor.CN03.AR01 When an object storage bucket deletion is attempted, the bucket MUST be
fully recoverable for a set time-frame after deletion is requested.
| Service supports bucket soft delete and recovery202 |
| CCC.ObjStor | CCC.ObjStor.CN03.AR02 When an attempt is made to modify the retention policy for an object
storage bucket, the service MUST prevent the policy from being modified.
| Service prevents modification of locked retention policy202 |
| CCC.ObjStor | CCC.ObjStor.CN04.AR01 When an object is uploaded to the object storage system, the object
MUST automatically receive a default retention policy that prevents
premature deletion or modification.
| Service applies default retention policy to newly uploaded object202 Service enforces retention policy on newly created objects220 Service validates retention period meets minimum requirements202 |
| CCC.ObjStor | CCC.ObjStor.CN04.AR02 When an attempt is made to delete or modify an object that is subject
to an active retention policy, the service MUST prevent the action
from being completed.
| Service allows object read access during retention period220 Service prevents object deletion by admin user during retention period220 Service prevents object deletion by write user during retention period202 Service prevents object modification during retention period202 |
| CCC.ObjStor | CCC.ObjStor.CN05.AR01 When an object is uploaded to the object storage bucket, the object
MUST be stored with a unique identifier.
| Service enables versioning and objects receive unique version identifiers202 |
| CCC.ObjStor | CCC.ObjStor.CN05.AR02 When an object is modified, the service MUST assign a new unique
identifier to the modified object to differentiate it from the
previous version.
| Modified objects receive new version identifiers202 |
| CCC.ObjStor | CCC.ObjStor.CN05.AR03 When an object is modified, the service MUST allow for recovery
of previous versions of the object.
| Modified objects receive new version identifiers220 |
| CCC.ObjStor | CCC.ObjStor.CN05.AR04 When an object is deleted, the service MUST retain other versions of
the object to allow for recovery of previous versions.
| Deleted object data can be reloaded from previous version220 Deleted object version remains in version list202 |
Resource Summary
Summary of all resources mentioned in OCSF results
| Resource Name | Resource Type | Control Catalogs | Total Tests | Passing | Failing |
|---|---|---|---|---|---|
/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | 82 | 54 | 28 | |
stgcfi20260410t121838z.blob.core.windows.net | object-storage | 22 | 16 | 6 |
Test Results
OCSF test results filtered for entries with CCC compliance mappings
| Status | Finding | Resource Name | Resource Type | Message | Test Requirements |
|---|---|---|---|---|---|
| PASS | Service accepts TLS 1.3 encrypted traffic ✓ a cloud api for "{Instance}" in "api"
✓ an openssl s_client request using "tls1_3" to "{portNumber}" on "{hostName}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ "{connection}" state is open
✓ "{connection.State}" is "open"
✓ I close connection "{connection}"
✓ "{connection}" state is closed | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Service accepts TLS 1.3 encrypted traffic | |
| PASS | Service rejects TLS 1.2 traffic ✓ a cloud api for "{Instance}" in "api"
✓ an openssl s_client request using "tls1_2" to "{portNumber}" on "{hostName}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ we wait for a period of "40" ms
✓ "{connection.State}" is "closed" | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Service rejects TLS 1.2 traffic | |
| PASS | Service rejects TLS 1.1 traffic ✓ a cloud api for "{Instance}" in "api"
✓ an openssl s_client request using "tls1_1" to "{portNumber}" on "{hostName}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ we wait for a period of "40" ms
✓ "{connection.State}" is "closed" | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Service rejects TLS 1.1 traffic | |
| PASS | Service rejects TLS 1.0 traffic ✓ a cloud api for "{Instance}" in "api"
✓ an openssl s_client request using "tls1" to "{portNumber}" on "{hostName}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ we wait for a period of "40" ms
✓ "{connection.State}" is "closed" | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Service rejects TLS 1.0 traffic | |
| FAIL | Verify SSL/TLS protocol support ✓ a cloud api for "{Instance}" in "api"
✓ "report" contains details of SSL Support type "protocols" for "{hostName}" on port "{portNumber}"
✗ "{report}" is an array of objects which doesn't contain any of - Error: unwanted row found in array: map[finding:offered id:TLS1_2]
⊘ "{report}" is an array of objects with at least the following contents (skipped) | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Verify SSL/TLS protocol support | |
| PASS | Verify no known SSL/TLS vulnerabilities ✓ a cloud api for "{Instance}" in "api"
✓ "report" contains details of SSL Support type "vulnerable" for "{hostName}" on port "{portNumber}"
✓ "{report}" is an array of objects with at least the following contents | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Verify no known SSL/TLS vulnerabilities | |
| PASS | Verify TLS 1.3 only certificate validity ✓ a cloud api for "{Instance}" in "api"
✓ "report" contains details of SSL Support type "server-defaults" for "{hostName}" on port "{portNumber}"
✓ "{report}" is an array of objects with at least the following contents | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Verify TLS 1.3 only certificate validity | |
| FAIL | HTTP redirects to HTTPS ✓ a client connects to "{hostName}" with protocol "http" on port "80"
✓ I refer to "{result}" as "connection"
✓ "{connection}" is not an error
✓ I transmit "GET / HTTP/1.1\r\nHost: {hostName}\r\n\r\n" to "{connection}"
✓ I attach "{connection}" to the test output as "HTTP response"
✗ "{connection.Output}" contains "301" - Error: expected {connection.Output} to contain '301', but got 'HTTP/1.1 400 The account being accessed does not support http.
Content-Length: 287
Content-Type: application/xml
x-ms-request-id: 2a064b0c-401e-00e7-35e9-c88445000000
Date: Fri, 10 Apr 2026 12:59:47 GMT
<?xml version="1.0" encoding="utf-8"?><Error><Code>AccountRequiresHttps</Code><Message>The account being accessed does not support http.
RequestId:2a064b0c-401e-00e7-35e9-c88445000000
Time:2026-04-10T12:59:47.2673023Z</Message><AccountName>stgcfi20260410t121838z</AccountName></Error>'
⊘ I call "{connection}" with "Close" (skipped)
⊘ "{connection.State}" is "closed" (skipped) | stgcfi20260410t121838z.blob.core.windows.net | object-storage | HTTP redirects to HTTPS | |
| PASS | Only secure protocols are exposed ✓ "report" contains details of SSL Support type "protocols" for "{hostName}" on port "{portNumber}"
✓ "{report}" is an array of objects with at least the following contents | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Only secure protocols are exposed | |
| PASS | Verify HTTPS uses IANA-assigned port 443 ✓ "{portNumber}" is "443" | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Verify HTTPS uses IANA-assigned port 443 | |
| FAIL | Verify mTLS requires client certificate authentication ✓ "report" contains details of SSL Support type "server-defaults" for "{hostName}" on port "{portNumber}"
✗ "{report}" is an array of objects with at least the following contents - Error: expected row not found: map[finding:required id:clientAuth] | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Verify mTLS requires client certificate authentication | |
| PASS | Verify objects are encrypted at rest ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ "{result}" is not an error
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "test-encryption-check={Timestamp}.txt", and "encryption test data"
✓ "{result}" is not an error
✓ I refer to "{result}" as "uploadResult"
✓ "{uploadResult.Encryption}" is not null
✓ "{uploadResult.EncryptionAlgorithm}" is "AES256"
✓ I attach "{uploadResult}" to the test output as "Upload Result with Encryption Details" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Verify objects are encrypted at rest | |
| PASS | MFA requirement for destructive operations cannot be tested automatically ✓ a cloud api for "{Instance}" in "api"
✓ no-op required | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | MFA requirement for destructive operations cannot be tested automatically | |
| PASS | Verify admin actions are logged with identity and timestamp ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "{ServiceType}"
✓ I refer to "{result}" as "theService"
✓ I call "{api}" with "GetServiceAPI" using argument "logging"
✓ I refer to "{result}" as "loggingService"
✓ I call "{theService}" with "UpdateResourcePolicy"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "Policy Update Result"
✓ we wait for a period of "10000" ms
✓ I call "{loggingService}" with "QueryAdminLogs" using arguments "{ResourceName}" and "{20}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "adminLogs"
✓ I attach "{adminLogs}" to the test output as "Admin Activity Logs"
✓ "{adminLogs}" is an array of objects with at least the following contents | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Verify admin actions are logged with identity and timestamp | |
| FAIL | Verify data read operations are logged with identity and timestamp ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "logging"
✓ I refer to "{result}" as "loggingService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "test-read-logging-object={Timestamp}.txt", and "test data for read logging verification"
✓ "{result}" is not an error
✓ I refer to "{result}" as "createResult"
✓ I call "{storage}" with "ReadObject" using arguments "{ResourceName}" and "test-read-logging-object={Timestamp}.txt"
✓ "{result}" is not an error
✓ I refer to "{result}" as "readResult"
✓ I attach "{readResult}" to the test output as "Object Read Result"
✓ we wait for a period of "10000" ms
✓ I call "{loggingService}" with "QueryDataReadLogs" using arguments "{ResourceName}" and "{20}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "readLogs"
✓ I attach "{readLogs}" to the test output as "Data Read Logs"
✗ "{readLogs}" is an array of objects with at least the following contents - Error: expected row not found: map[result:Succeeded] | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Verify data read operations are logged with identity and timestamp | |
| FAIL | Service prevents data modification by user with no access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-no-access", "{UID}", and "none"
✓ I refer to "{result}" as "testUserNoAccess"
✓ I attach "{result}" to the test output as "no-access-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserNoAccess}", and "{false}"
✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: Error calling {api}.GetServiceAPIWithIdentity: reflect: Call using *fmt.wrapError as type *iam.Identity
⊘ I refer to "{result}" as "userStorage" (skipped)
⊘ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "test-cn05-unauthorized-modify={Timestamp}.txt", and "unauthorized data" (skipped)
⊘ "{result}" is an error (skipped)
⊘ I attach "{result}" to the test output as "no-access-create-error.txt" (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents data modification by user with no access | |
| PASS | Service allows data modification by user with write access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-write-access", "{UID}", and "write"
✓ I refer to "{result}" as "testUserWrite"
✓ I attach "{result}" to the test output as "write-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserWrite}", and "{true}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "test-cn05-authorized-modify={Timestamp}.txt", and "authorized data"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "write-create-object-result.json" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service allows data modification by user with write access | |
| PASS | Service prevents administrative action (creating a new bucket) by user with no access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-no-access", "{UID}", and "none"
✓ I refer to "{result}" as "testUserNoAccess"
✓ I attach "{result}" to the test output as "no-admin-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserNoAccess}", and "{false}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateBucket" using argument "test-cn05-unauthorized-admin-container"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "no-admin-create-bucket-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents administrative action (creating a new bucket) by user with no access | |
| PASS | Service prevents administrative action (creating a new bucket) by user with read-only access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-read-only-admin", "{UID}", and "read"
✓ I refer to "{result}" as "testUserRead"
✓ I attach "{result}" to the test output as "read-only-admin-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserRead}", and "{false}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateBucket" using argument "test-cn05-read-only-create-container"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "read-only-create-bucket-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents administrative action (creating a new bucket) by user with read-only access | |
| FAIL | Service allows administrative action (creating a new bucket) by user with admin access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-admin-access", "{UID}", and "admin"
✓ I refer to "{result}" as "testUserAdmin"
✓ I attach "{result}" to the test output as "admin-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserAdmin}", and "{true}"
✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: user provisioning validation failed: user permissions validation timed out after 12 attempts: credentials not ready for Azure Blob Storage access: failed to list containers: GET https://stgcfi20260410t121838z.blob.core.windows.net/
--------------------------------------------------------------------------------
RESPONSE 403: 403 This request is not authorized to perform this operation using this permission.
ERROR CODE: AuthorizationPermissionMismatch
--------------------------------------------------------------------------------
<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission.
RequestId:c3b8d84b-001e-00d9-09e6-c8133a000000
Time:2026-04-10T12:31:58.7596818Z</Message></Error>
--------------------------------------------------------------------------------
⊘ I refer to "{result}" as "userStorage" (skipped)
⊘ I call "{userStorage}" with "CreateBucket" using argument "test-cn05-authorized-admin-container" (skipped)
⊘ "{result}" is not an error (skipped)
⊘ I attach "{result}" to the test output as "admin-create-bucket-result.json" (skipped)
⊘ I call "{storage}" with "DeleteBucket" using argument "test-cn05-authorized-admin-container" (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service allows administrative action (creating a new bucket) by user with admin access | |
| PASS | Service prevents data read by user with no access - Duplicate ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ no-op required | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents data read by user with no access - Duplicate | |
| FAIL | Resource region can be retrieved for compliance verification ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "{ServiceType}"
✓ I refer to "{result}" as "theService"
✓ I call "{theService}" with "GetResourceRegion" using argument "{ResourceName}"
✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: not yet implemented
⊘ I refer to "{result}" as "region" (skipped)
⊘ I attach "{region}" to the test output as "Resource Region" (skipped)
⊘ "{PermittedRegions}" is an array of objects with at least the following contents (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Resource region can be retrieved for compliance verification | |
| PASS | Child resource region compliance - NotTestable ✓ a cloud api for "{Instance}" in "api"
✓ no-op required | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Child resource region compliance - NotTestable | |
| PASS | Enumeration event publishing cannot be tested automatically - NotTestable ✓ a cloud api for "{Instance}" in "api"
✓ no-op required | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Enumeration event publishing cannot be tested automatically - NotTestable | |
| PASS | Enumeration logging cannot be verified automatically - NotTestable ✓ a cloud api for "{Instance}" in "api"
✓ no-op required | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Enumeration logging cannot be verified automatically - NotTestable | |
| PASS | Bucket data is replicated to physically separate locations ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "GetReplicationStatus" using argument "{ResourceName}"
✓ I refer to "{result}" as "replicationStatus"
✓ I refer to "{replicationStatus.Locations}" as "locations"
✓ I attach "{replicationStatus}" to the test output as "Replication Status"
✓ "{locations}" is an array of objects with length "2"
✓ "{PermittedRegions}" is an array of objects with at least the following contents
✓ "{PermittedRegions}" is an array of objects with at least the following contents | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Bucket data is replicated to physically separate locations | |
| PASS | Replication status can be retrieved for monitoring ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "GetReplicationStatus" using argument "{ResourceName}"
✓ I refer to "{result}" as "replicationStatus"
✓ I attach "{replicationStatus}" to the test output as "Replication Status"
✓ I refer to "{replicationStatus.Locations}" as "locations"
✓ "{locations}" is an array of objects with at least the following contents | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Replication status can be retrieved for monitoring | |
| PASS | Replication destination trust cannot be verified automatically - NotTestable ✓ a cloud api for "{Instance}" in "api"
✓ no-op required | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Replication destination trust cannot be verified automatically - NotTestable | |
| PASS | Service prevents reading bucket with no access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-no-access", "{UID}", and "none"
✓ I refer to "{result}" as "testUserNoAccess"
✓ I attach "{result}" to the test output as "no-access-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserNoAccess}", and "{false}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "ListObjects" using argument "{ResourceName}"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "no-access-list-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents reading bucket with no access | |
| PASS | Service allows reading bucket with read access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-read", "{UID}", and "read"
✓ I refer to "{result}" as "testUserRead"
✓ I attach "{result}" to the test output as "read-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserRead}", and "{true}"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "read-storage-service.json"
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "ListObjects" using argument "{ResourceName}"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "read-list-objects-result.json" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service allows reading bucket with read access | |
| PASS | Service prevents reading object with no access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "test-object={Timestamp}.txt", and "test content"
✓ "{result}" is not an error
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-no-access", "{UID}", and "none"
✓ I refer to "{result}" as "testUserNoAccess"
✓ I attach "{result}" to the test output as "no-access-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserNoAccess}", and "{false}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "ReadObject" using arguments "{ResourceName}" and "test-object={Timestamp}.txt"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "no-access-read-object-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents reading object with no access | |
| PASS | Service allows reading object with read access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "test-object={Timestamp}.txt", and "test content"
✓ "{result}" is not an error
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-read", "{UID}", and "read"
✓ I refer to "{result}" as "testUserRead"
✓ I attach "{result}" to the test output as "read-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserRead}", and "{true}"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "read-storage-service.json"
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "ReadObject" using arguments "{ResourceName}" and "test-object={Timestamp}.txt"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "read-read-object-result.json" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service allows reading object with read access | |
| PASS | Service prevents creating bucket with no access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-no-access", "{UID}", and "none"
✓ I refer to "{result}" as "testUserNoAccess"
✓ I attach "{result}" to the test output as "no-access-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserNoAccess}", and "{false}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateBucket" using argument "test-bucket-no-access"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "no-access-create-bucket-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents creating bucket with no access | |
| FAIL | Service allows creating bucket with write access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-write", "{UID}", and "write"
✓ I refer to "{result}" as "testUserWrite"
✓ I attach "{result}" to the test output as "write-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserWrite}", and "{true}"
✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: user provisioning validation failed: user permissions validation timed out after 12 attempts: credentials not ready for Azure Blob Storage access: failed to list containers: GET https://stgcfi20260410t121838z.blob.core.windows.net/
--------------------------------------------------------------------------------
RESPONSE 403: 403 This request is not authorized to perform this operation using this permission.
ERROR CODE: AuthorizationPermissionMismatch
--------------------------------------------------------------------------------
<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission.
RequestId:c3bf4821-001e-00d9-5ae8-c8133a000000
Time:2026-04-10T12:46:34.9851799Z</Message></Error>
--------------------------------------------------------------------------------
⊘ I attach "{result}" to the test output as "write-storage-service.json" (skipped)
⊘ I refer to "{result}" as "userStorage" (skipped)
⊘ I call "{userStorage}" with "CreateBucket" using argument "test-bucket-write" (skipped)
⊘ "{result}" is not an error (skipped)
⊘ I attach "{result}" to the test output as "write-create-bucket-result.json" (skipped)
⊘ I call "{storage}" with "DeleteBucket" using argument "{result.ID}" (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service allows creating bucket with write access | |
| PASS | Service prevents writing object with read-only access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ "{result}" is not an error
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ "{result}" is not an error
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-read", "{UID}", and "read"
✓ I refer to "{result}" as "testUserRead"
✓ I attach "{result}" to the test output as "read-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserRead}", and "{true}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "test-write-object={Timestamp}.txt", and "test content"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "read-create-object-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents writing object with read-only access | |
| PASS | Service allows writing object with write access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ "{result}" is not an error
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ "{result}" is not an error
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-write", "{UID}", and "write"
✓ I refer to "{result}" as "testUserWrite"
✓ I attach "{result}" to the test output as "write-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserWrite}", and "{true}"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "write-storage-service.json"
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "test-write-object={Timestamp}.txt", and "test content"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "write-create-object-result.json" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service allows writing object with write access | |
| PASS | Service enforces uniform bucket-level access by rejecting object-level permissions ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "test-object={Timestamp}.txt", and "test data"
✓ "{result}" is not an error
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-read", "{UID}", and "read"
✓ I refer to "{result}" as "testUserRead"
✓ I attach "{result}" to the test output as "read-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserRead}", and "{true}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "ReadObject" using arguments "{ResourceName}" and "test-object={Timestamp}.txt"
✓ "{result}" is not an error
✓ I call "{storage}" with "SetObjectPermission" using arguments "{ResourceName}", "test-object={Timestamp}.txt", and "none"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "set-object-permission-error.txt"
✓ I call "{userStorage}" with "ReadObject" using arguments "{ResourceName}" and "test-object={Timestamp}.txt"
✓ "{result}" is not an error | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service enforces uniform bucket-level access by rejecting object-level permissions | |
| PASS | Service enforces uniform bucket-level access denial ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "test-object={Timestamp}.txt", and "test data"
✓ "{result}" is not an error
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-no-access", "{UID}", and "none"
✓ I refer to "{result}" as "testUserNoAccess"
✓ I attach "{result}" to the test output as "no-access-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserNoAccess}", and "{false}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "ReadObject" using arguments "{ResourceName}" and "test-object={Timestamp}.txt"
✓ "{result}" is an error
✓ I call "{storage}" with "SetObjectPermission" using arguments "{ResourceName}", "test-object={Timestamp}.txt", and "read"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "set-object-permission-error.txt"
✓ I call "{userStorage}" with "ReadObject" using arguments "{ResourceName}" and "test-object={Timestamp}.txt"
✓ "{result}" is an error | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service enforces uniform bucket-level access denial | |
| FAIL | Service supports bucket soft delete and recovery ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "CreateBucket" using argument "ccc-test-soft-delete"
✓ "{result}" is not an error
✓ I refer to "{result}" as "testBucket"
✓ I attach "{result}" to the test output as "created-bucket.json"
✓ I call "{storage}" with "DeleteBucket" using argument "ccc-test-soft-delete"
✓ "{result}" is not an error
✓ I call "{storage}" with "ListDeletedBuckets"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "deleted-buckets.json"
? "{result}" should have length greater than "0" (undefined)
⊘ I call "{storage}" with "RestoreBucket" using argument "ccc-test-soft-delete" (skipped)
⊘ "{result}" is not an error (skipped)
⊘ I call "{storage}" with "ListBuckets" (skipped)
⊘ "{result}" is not an error (skipped)
⊘ I attach "{result}" to the test output as "restored-buckets.json" (skipped)
⊘ I call "{storage}" with "DeleteBucket" using argument "ccc-test-soft-delete" (skipped)
⊘ "{result}" is not an error (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service supports bucket soft delete and recovery | |
| FAIL | Service prevents modification of locked retention policy ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "GetBucketRetentionDurationDays" using argument "{ResourceName}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "originalRetention"
✓ I attach "{result}" to the test output as "original-retention-days.txt"
✗ "{result}" should be greater than "0" - Error: expected {result} (0) to be greater than 0
⊘ I call "{storage}" with "SetBucketRetentionDurationDays" using arguments "{ResourceName}" and "1" (skipped)
⊘ "{result}" is an error (skipped)
⊘ I attach "{result}" to the test output as "set-retention-error.txt" (skipped)
⊘ I call "{storage}" with "GetBucketRetentionDurationDays" using argument "{ResourceName}" (skipped)
⊘ "{result}" is not an error (skipped)
? "{result}" should equal "{originalRetention}" (undefined) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents modification of locked retention policy | |
| FAIL | Service applies default retention policy to newly uploaded object ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-write", "{UID}", and "write"
✓ I refer to "{result}" as "testUserWrite"
✓ I attach "{result}" to the test output as "write-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserWrite}", and "{true}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "test-retention-object={Timestamp}.txt", and "protected data"
✓ I attach "{result}" to the test output as "uploaded-object.json"
✓ I call "{userStorage}" with "GetObjectRetentionDurationDays" using arguments "{ResourceName}" and "test-retention-object={Timestamp}.txt"
✗ "{result}" should be greater than "1" - Error: expected {result} (0) to be greater than 1 | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service applies default retention policy to newly uploaded object | |
| PASS | Service enforces retention policy on newly created objects ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "immediate-delete-test={Timestamp}.txt", and "test content"
✓ "{result}" is not an error
✓ I call "{storage}" with "DeleteObject" using arguments "{ResourceName}" and "immediate-delete-test={Timestamp}.txt"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "immediate-delete-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service enforces retention policy on newly created objects | |
| FAIL | Service validates retention period meets minimum requirements ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "retention-period-test={Timestamp}.txt", and "compliance data"
✓ I call "{storage}" with "GetObjectRetentionDurationDays" using arguments "{ResourceName}" and "retention-period-test={Timestamp}.txt"
✗ "{result}" should be greater than "1" - Error: expected {result} (0) to be greater than 1
⊘ I attach "{result}" to the test output as "retention-period-days.json" (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service validates retention period meets minimum requirements | |
| FAIL | Service prevents object deletion by write user during retention period ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-write", "{UID}", and "write"
✓ I refer to "{result}" as "testUserWrite"
✓ I attach "{result}" to the test output as "write-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserWrite}", and "{true}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "protected-object={Timestamp}.txt", and "immutable data"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "protected-object.json"
✓ I call "{userStorage}" with "DeleteObject" using arguments "{ResourceName}" and "protected-object={Timestamp}.txt"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "delete-protected-error.txt"
? "{result}" should contain one of "retention, locked, immutable, protected" (undefined) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents object deletion by write user during retention period | |
| PASS | Service prevents object deletion by admin user during retention period ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "admin-protected-object={Timestamp}.txt", and "compliance data"
✓ "{result}" is not an error
✓ I call "{storage}" with "DeleteObject" using arguments "{ResourceName}" and "admin-protected-object={Timestamp}.txt"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "admin-delete-protected-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents object deletion by admin user during retention period | |
| FAIL | Service prevents object modification during retention period ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-write", "{UID}", and "write"
✓ I refer to "{result}" as "testUserWrite"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserWrite}", and "{true}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "modify-test-object={Timestamp}.txt", and "original content"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "original-object.json"
✓ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "modify-test-object={Timestamp}.txt", and "modified content"
✗ "{result}" is an error - Error: expected {result} to be an error, got *objstorage.Object
⊘ I attach "{result}" to the test output as "modify-protected-error.txt" (skipped)
? "{result}" should contain one of "retention, locked, immutable, protected, exists" (undefined) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents object modification during retention period | |
| PASS | Service allows object read access during retention period ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "readable-protected-object={Timestamp}.txt", and "readable data"
✓ "{result}" is not an error
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-read", "{UID}", and "read"
✓ I refer to "{result}" as "testUserRead"
✓ I attach "{result}" to the test output as "read-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserRead}", and "{true}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "ReadObject" using arguments "{ResourceName}" and "readable-protected-object={Timestamp}.txt"
✓ "{result}" is not an error
✓ I refer to "{result}" as "readResult"
✓ I attach "{result}" to the test output as "read-protected-object.json"
✓ "{readResult.Name}" is "readable-protected-object={Timestamp}.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service allows object read access during retention period | |
| FAIL | Service enables versioning and objects receive unique version identifiers ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "IsBucketVersioningEnabled" using argument "{ResourceName}"
✓ "{result}" is true
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "versioned-object.txt", and "test content"
✓ I refer to "{result}" as "createdObject"
? "{createdObject.VersionID}" is not empty (undefined)
⊘ I attach "{result}" to the test output as "versioned-object.json" (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service enables versioning and objects receive unique version identifiers | |
| FAIL | Modified objects receive new version identifiers ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "version-test-object={Timestamp}.txt", and "original content"
✓ I refer to "{result.VersionID}" as "version1"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "version-test-object={Timestamp}.txt", and "modified content"
✓ I refer to "{result.VersionID}" as "version2"
? "{version1}" is not equal to "{version2}" (undefined) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Modified objects receive new version identifiers | |
| PASS | Modified objects receive new version identifiers ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "version-test-object={Timestamp}.txt", and "original content"
✓ I refer to "{result.VersionID}" as "version1"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "version-test-object={Timestamp}.txt", and "modified content"
✓ I refer to "{result.VersionID}" as "version2"
✓ I call "{storage}" with "ReadObjectAtVersion" using arguments "{ResourceName}", "version-test-object={Timestamp}.txt", and "{version1}"
✓ I attach "{result}" to the test output as "original-content.json"
✓ "{result.Data}" contains "original content"
✓ I call "{storage}" with "ReadObjectAtVersion" using arguments "{ResourceName}", "version-test-object={Timestamp}.txt", and "{version2}"
✓ "{result.Data}" contains "modified content"
✓ I attach "{result}" to the test output as "modified-content.json" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Modified objects receive new version identifiers | |
| PASS | Deleted object data can be reloaded from previous version ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "recover-deleted-object={Timestamp}.txt", and "data to retain"
✓ I refer to "{result.VersionID}" as "retainedVersionId"
✓ I call "{storage}" with "DeleteObject" using arguments "{ResourceName}" and "recover-deleted-object={Timestamp}.txt"
✓ I call "{storage}" with "ReadObjectAtVersion" using arguments "{ResourceName}", "recover-deleted-object={Timestamp}.txt", and "{retainedVersionId}"
✓ "{result.Data}" contains "data to retain"
✓ I attach "{result}" to the test output as "recovered-deleted-version.json" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Deleted object data can be reloaded from previous version | |
| FAIL | Deleted object version remains in version list ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "list-deleted-versions-object={Timestamp}.txt", and "versioned data"
✓ I refer to "{result.VersionID}" as "listedVersionId"
✓ I call "{storage}" with "DeleteObject" using arguments "{ResourceName}" and "list-deleted-versions-object={Timestamp}.txt"
✓ I call "{storage}" with "ListObjectVersions" using arguments "{ResourceName}" and "list-deleted-versions-object={Timestamp}.txt"
✗ "{result}" is an array of objects with at least the following contents - Error: field {result} is not an array
⊘ I attach "{result}" to the test output as "versions-after-delete.json" (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Deleted object version remains in version list | |
| PASS | Service accepts TLS 1.3 encrypted traffic ✓ a cloud api for "{Instance}" in "api"
✓ an openssl s_client request using "tls1_3" to "{portNumber}" on "{hostName}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ "{connection}" state is open
✓ "{connection.State}" is "open"
✓ I close connection "{connection}"
✓ "{connection}" state is closed | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Service accepts TLS 1.3 encrypted traffic | |
| PASS | Service rejects TLS 1.2 traffic ✓ a cloud api for "{Instance}" in "api"
✓ an openssl s_client request using "tls1_2" to "{portNumber}" on "{hostName}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ we wait for a period of "40" ms
✓ "{connection.State}" is "closed" | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Service rejects TLS 1.2 traffic | |
| PASS | Service rejects TLS 1.1 traffic ✓ a cloud api for "{Instance}" in "api"
✓ an openssl s_client request using "tls1_1" to "{portNumber}" on "{hostName}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ we wait for a period of "40" ms
✓ "{connection.State}" is "closed" | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Service rejects TLS 1.1 traffic | |
| PASS | Service rejects TLS 1.0 traffic ✓ a cloud api for "{Instance}" in "api"
✓ an openssl s_client request using "tls1" to "{portNumber}" on "{hostName}" protocol "{protocol}"
✓ I refer to "{result}" as "connection"
✓ we wait for a period of "40" ms
✓ "{connection.State}" is "closed" | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Service rejects TLS 1.0 traffic | |
| FAIL | Verify SSL/TLS protocol support ✓ a cloud api for "{Instance}" in "api"
✓ "report" contains details of SSL Support type "protocols" for "{hostName}" on port "{portNumber}"
✗ "{report}" is an array of objects which doesn't contain any of - Error: unwanted row found in array: map[finding:offered id:TLS1_2]
⊘ "{report}" is an array of objects with at least the following contents (skipped) | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Verify SSL/TLS protocol support | |
| PASS | Verify no known SSL/TLS vulnerabilities ✓ a cloud api for "{Instance}" in "api"
✓ "report" contains details of SSL Support type "vulnerable" for "{hostName}" on port "{portNumber}"
✓ "{report}" is an array of objects with at least the following contents | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Verify no known SSL/TLS vulnerabilities | |
| PASS | Verify TLS 1.3 only certificate validity ✓ a cloud api for "{Instance}" in "api"
✓ "report" contains details of SSL Support type "server-defaults" for "{hostName}" on port "{portNumber}"
✓ "{report}" is an array of objects with at least the following contents | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Verify TLS 1.3 only certificate validity | |
| FAIL | HTTP redirects to HTTPS ✓ a client connects to "{hostName}" with protocol "http" on port "80"
✓ I refer to "{result}" as "connection"
✓ "{connection}" is not an error
✓ I transmit "GET / HTTP/1.1\r\nHost: {hostName}\r\n\r\n" to "{connection}"
✓ I attach "{connection}" to the test output as "HTTP response"
✗ "{connection.Output}" contains "301" - Error: expected {connection.Output} to contain '301', but got 'HTTP/1.1 400 The account being accessed does not support http.
Content-Length: 287
Content-Type: application/xml
x-ms-request-id: 2a064b0c-401e-00e7-35e9-c88445000000
Date: Fri, 10 Apr 2026 12:59:47 GMT
<?xml version="1.0" encoding="utf-8"?><Error><Code>AccountRequiresHttps</Code><Message>The account being accessed does not support http.
RequestId:2a064b0c-401e-00e7-35e9-c88445000000
Time:2026-04-10T12:59:47.2673023Z</Message><AccountName>stgcfi20260410t121838z</AccountName></Error>'
⊘ I call "{connection}" with "Close" (skipped)
⊘ "{connection.State}" is "closed" (skipped) | stgcfi20260410t121838z.blob.core.windows.net | object-storage | HTTP redirects to HTTPS | |
| PASS | Only secure protocols are exposed ✓ "report" contains details of SSL Support type "protocols" for "{hostName}" on port "{portNumber}"
✓ "{report}" is an array of objects with at least the following contents | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Only secure protocols are exposed | |
| PASS | Verify HTTPS uses IANA-assigned port 443 ✓ "{portNumber}" is "443" | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Verify HTTPS uses IANA-assigned port 443 | |
| FAIL | Verify mTLS requires client certificate authentication ✓ "report" contains details of SSL Support type "server-defaults" for "{hostName}" on port "{portNumber}"
✗ "{report}" is an array of objects with at least the following contents - Error: expected row not found: map[finding:required id:clientAuth] | stgcfi20260410t121838z.blob.core.windows.net | object-storage | Verify mTLS requires client certificate authentication | |
| PASS | Verify objects are encrypted at rest ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ "{result}" is not an error
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "test-encryption-check={Timestamp}.txt", and "encryption test data"
✓ "{result}" is not an error
✓ I refer to "{result}" as "uploadResult"
✓ "{uploadResult.Encryption}" is not null
✓ "{uploadResult.EncryptionAlgorithm}" is "AES256"
✓ I attach "{uploadResult}" to the test output as "Upload Result with Encryption Details" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Verify objects are encrypted at rest | |
| PASS | MFA requirement for destructive operations cannot be tested automatically ✓ a cloud api for "{Instance}" in "api"
✓ no-op required | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | MFA requirement for destructive operations cannot be tested automatically | |
| PASS | Verify admin actions are logged with identity and timestamp ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "{ServiceType}"
✓ I refer to "{result}" as "theService"
✓ I call "{api}" with "GetServiceAPI" using argument "logging"
✓ I refer to "{result}" as "loggingService"
✓ I call "{theService}" with "UpdateResourcePolicy"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "Policy Update Result"
✓ we wait for a period of "10000" ms
✓ I call "{loggingService}" with "QueryAdminLogs" using arguments "{ResourceName}" and "{20}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "adminLogs"
✓ I attach "{adminLogs}" to the test output as "Admin Activity Logs"
✓ "{adminLogs}" is an array of objects with at least the following contents | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Verify admin actions are logged with identity and timestamp | |
| FAIL | Verify data read operations are logged with identity and timestamp ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "logging"
✓ I refer to "{result}" as "loggingService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "test-read-logging-object={Timestamp}.txt", and "test data for read logging verification"
✓ "{result}" is not an error
✓ I refer to "{result}" as "createResult"
✓ I call "{storage}" with "ReadObject" using arguments "{ResourceName}" and "test-read-logging-object={Timestamp}.txt"
✓ "{result}" is not an error
✓ I refer to "{result}" as "readResult"
✓ I attach "{readResult}" to the test output as "Object Read Result"
✓ we wait for a period of "10000" ms
✓ I call "{loggingService}" with "QueryDataReadLogs" using arguments "{ResourceName}" and "{20}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "readLogs"
✓ I attach "{readLogs}" to the test output as "Data Read Logs"
✗ "{readLogs}" is an array of objects with at least the following contents - Error: expected row not found: map[result:Succeeded] | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Verify data read operations are logged with identity and timestamp | |
| FAIL | Service prevents data modification by user with no access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-no-access", "{UID}", and "none"
✓ I refer to "{result}" as "testUserNoAccess"
✓ I attach "{result}" to the test output as "no-access-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserNoAccess}", and "{false}"
✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: Error calling {api}.GetServiceAPIWithIdentity: reflect: Call using *fmt.wrapError as type *iam.Identity
⊘ I refer to "{result}" as "userStorage" (skipped)
⊘ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "test-cn05-unauthorized-modify={Timestamp}.txt", and "unauthorized data" (skipped)
⊘ "{result}" is an error (skipped)
⊘ I attach "{result}" to the test output as "no-access-create-error.txt" (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents data modification by user with no access | |
| PASS | Service allows data modification by user with write access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-write-access", "{UID}", and "write"
✓ I refer to "{result}" as "testUserWrite"
✓ I attach "{result}" to the test output as "write-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserWrite}", and "{true}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "test-cn05-authorized-modify={Timestamp}.txt", and "authorized data"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "write-create-object-result.json" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service allows data modification by user with write access | |
| PASS | Service prevents administrative action (creating a new bucket) by user with no access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-no-access", "{UID}", and "none"
✓ I refer to "{result}" as "testUserNoAccess"
✓ I attach "{result}" to the test output as "no-admin-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserNoAccess}", and "{false}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateBucket" using argument "test-cn05-unauthorized-admin-container"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "no-admin-create-bucket-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents administrative action (creating a new bucket) by user with no access | |
| PASS | Service prevents administrative action (creating a new bucket) by user with read-only access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-read-only-admin", "{UID}", and "read"
✓ I refer to "{result}" as "testUserRead"
✓ I attach "{result}" to the test output as "read-only-admin-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserRead}", and "{false}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateBucket" using argument "test-cn05-read-only-create-container"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "read-only-create-bucket-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents administrative action (creating a new bucket) by user with read-only access | |
| FAIL | Service allows administrative action (creating a new bucket) by user with admin access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-admin-access", "{UID}", and "admin"
✓ I refer to "{result}" as "testUserAdmin"
✓ I attach "{result}" to the test output as "admin-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserAdmin}", and "{true}"
✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: user provisioning validation failed: user permissions validation timed out after 12 attempts: credentials not ready for Azure Blob Storage access: failed to list containers: GET https://stgcfi20260410t121838z.blob.core.windows.net/
--------------------------------------------------------------------------------
RESPONSE 403: 403 This request is not authorized to perform this operation using this permission.
ERROR CODE: AuthorizationPermissionMismatch
--------------------------------------------------------------------------------
<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission.
RequestId:c3b8d84b-001e-00d9-09e6-c8133a000000
Time:2026-04-10T12:31:58.7596818Z</Message></Error>
--------------------------------------------------------------------------------
⊘ I refer to "{result}" as "userStorage" (skipped)
⊘ I call "{userStorage}" with "CreateBucket" using argument "test-cn05-authorized-admin-container" (skipped)
⊘ "{result}" is not an error (skipped)
⊘ I attach "{result}" to the test output as "admin-create-bucket-result.json" (skipped)
⊘ I call "{storage}" with "DeleteBucket" using argument "test-cn05-authorized-admin-container" (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service allows administrative action (creating a new bucket) by user with admin access | |
| PASS | Service prevents data read by user with no access - Duplicate ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ no-op required | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents data read by user with no access - Duplicate | |
| FAIL | Resource region can be retrieved for compliance verification ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "{ServiceType}"
✓ I refer to "{result}" as "theService"
✓ I call "{theService}" with "GetResourceRegion" using argument "{ResourceName}"
✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: not yet implemented
⊘ I refer to "{result}" as "region" (skipped)
⊘ I attach "{region}" to the test output as "Resource Region" (skipped)
⊘ "{PermittedRegions}" is an array of objects with at least the following contents (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Resource region can be retrieved for compliance verification | |
| PASS | Child resource region compliance - NotTestable ✓ a cloud api for "{Instance}" in "api"
✓ no-op required | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Child resource region compliance - NotTestable | |
| PASS | Enumeration event publishing cannot be tested automatically - NotTestable ✓ a cloud api for "{Instance}" in "api"
✓ no-op required | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Enumeration event publishing cannot be tested automatically - NotTestable | |
| PASS | Enumeration logging cannot be verified automatically - NotTestable ✓ a cloud api for "{Instance}" in "api"
✓ no-op required | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Enumeration logging cannot be verified automatically - NotTestable | |
| PASS | Bucket data is replicated to physically separate locations ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "GetReplicationStatus" using argument "{ResourceName}"
✓ I refer to "{result}" as "replicationStatus"
✓ I refer to "{replicationStatus.Locations}" as "locations"
✓ I attach "{replicationStatus}" to the test output as "Replication Status"
✓ "{locations}" is an array of objects with length "2"
✓ "{PermittedRegions}" is an array of objects with at least the following contents
✓ "{PermittedRegions}" is an array of objects with at least the following contents | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Bucket data is replicated to physically separate locations | |
| PASS | Replication status can be retrieved for monitoring ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "GetReplicationStatus" using argument "{ResourceName}"
✓ I refer to "{result}" as "replicationStatus"
✓ I attach "{replicationStatus}" to the test output as "Replication Status"
✓ I refer to "{replicationStatus.Locations}" as "locations"
✓ "{locations}" is an array of objects with at least the following contents | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Replication status can be retrieved for monitoring | |
| PASS | Replication destination trust cannot be verified automatically - NotTestable ✓ a cloud api for "{Instance}" in "api"
✓ no-op required | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Replication destination trust cannot be verified automatically - NotTestable | |
| PASS | Service prevents reading bucket with no access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-no-access", "{UID}", and "none"
✓ I refer to "{result}" as "testUserNoAccess"
✓ I attach "{result}" to the test output as "no-access-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserNoAccess}", and "{false}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "ListObjects" using argument "{ResourceName}"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "no-access-list-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents reading bucket with no access | |
| PASS | Service allows reading bucket with read access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-read", "{UID}", and "read"
✓ I refer to "{result}" as "testUserRead"
✓ I attach "{result}" to the test output as "read-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserRead}", and "{true}"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "read-storage-service.json"
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "ListObjects" using argument "{ResourceName}"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "read-list-objects-result.json" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service allows reading bucket with read access | |
| PASS | Service prevents reading object with no access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "test-object={Timestamp}.txt", and "test content"
✓ "{result}" is not an error
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-no-access", "{UID}", and "none"
✓ I refer to "{result}" as "testUserNoAccess"
✓ I attach "{result}" to the test output as "no-access-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserNoAccess}", and "{false}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "ReadObject" using arguments "{ResourceName}" and "test-object={Timestamp}.txt"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "no-access-read-object-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents reading object with no access | |
| PASS | Service allows reading object with read access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "test-object={Timestamp}.txt", and "test content"
✓ "{result}" is not an error
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-read", "{UID}", and "read"
✓ I refer to "{result}" as "testUserRead"
✓ I attach "{result}" to the test output as "read-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserRead}", and "{true}"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "read-storage-service.json"
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "ReadObject" using arguments "{ResourceName}" and "test-object={Timestamp}.txt"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "read-read-object-result.json" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service allows reading object with read access | |
| PASS | Service prevents creating bucket with no access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-no-access", "{UID}", and "none"
✓ I refer to "{result}" as "testUserNoAccess"
✓ I attach "{result}" to the test output as "no-access-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserNoAccess}", and "{false}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateBucket" using argument "test-bucket-no-access"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "no-access-create-bucket-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents creating bucket with no access | |
| FAIL | Service allows creating bucket with write access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-write", "{UID}", and "write"
✓ I refer to "{result}" as "testUserWrite"
✓ I attach "{result}" to the test output as "write-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserWrite}", and "{true}"
✗ "{result}" is not an error - Error: expected {result} to not be an error, but got: user provisioning validation failed: user permissions validation timed out after 12 attempts: credentials not ready for Azure Blob Storage access: failed to list containers: GET https://stgcfi20260410t121838z.blob.core.windows.net/
--------------------------------------------------------------------------------
RESPONSE 403: 403 This request is not authorized to perform this operation using this permission.
ERROR CODE: AuthorizationPermissionMismatch
--------------------------------------------------------------------------------
<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission.
RequestId:c3bf4821-001e-00d9-5ae8-c8133a000000
Time:2026-04-10T12:46:34.9851799Z</Message></Error>
--------------------------------------------------------------------------------
⊘ I attach "{result}" to the test output as "write-storage-service.json" (skipped)
⊘ I refer to "{result}" as "userStorage" (skipped)
⊘ I call "{userStorage}" with "CreateBucket" using argument "test-bucket-write" (skipped)
⊘ "{result}" is not an error (skipped)
⊘ I attach "{result}" to the test output as "write-create-bucket-result.json" (skipped)
⊘ I call "{storage}" with "DeleteBucket" using argument "{result.ID}" (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service allows creating bucket with write access | |
| PASS | Service prevents writing object with read-only access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ "{result}" is not an error
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ "{result}" is not an error
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-read", "{UID}", and "read"
✓ I refer to "{result}" as "testUserRead"
✓ I attach "{result}" to the test output as "read-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserRead}", and "{true}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "test-write-object={Timestamp}.txt", and "test content"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "read-create-object-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents writing object with read-only access | |
| PASS | Service allows writing object with write access ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ "{result}" is not an error
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ "{result}" is not an error
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-write", "{UID}", and "write"
✓ I refer to "{result}" as "testUserWrite"
✓ I attach "{result}" to the test output as "write-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserWrite}", and "{true}"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "write-storage-service.json"
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "test-write-object={Timestamp}.txt", and "test content"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "write-create-object-result.json" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service allows writing object with write access | |
| PASS | Service enforces uniform bucket-level access by rejecting object-level permissions ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "test-object={Timestamp}.txt", and "test data"
✓ "{result}" is not an error
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-read", "{UID}", and "read"
✓ I refer to "{result}" as "testUserRead"
✓ I attach "{result}" to the test output as "read-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserRead}", and "{true}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "ReadObject" using arguments "{ResourceName}" and "test-object={Timestamp}.txt"
✓ "{result}" is not an error
✓ I call "{storage}" with "SetObjectPermission" using arguments "{ResourceName}", "test-object={Timestamp}.txt", and "none"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "set-object-permission-error.txt"
✓ I call "{userStorage}" with "ReadObject" using arguments "{ResourceName}" and "test-object={Timestamp}.txt"
✓ "{result}" is not an error | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service enforces uniform bucket-level access by rejecting object-level permissions | |
| PASS | Service enforces uniform bucket-level access denial ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "test-object={Timestamp}.txt", and "test data"
✓ "{result}" is not an error
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-no-access", "{UID}", and "none"
✓ I refer to "{result}" as "testUserNoAccess"
✓ I attach "{result}" to the test output as "no-access-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserNoAccess}", and "{false}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "ReadObject" using arguments "{ResourceName}" and "test-object={Timestamp}.txt"
✓ "{result}" is an error
✓ I call "{storage}" with "SetObjectPermission" using arguments "{ResourceName}", "test-object={Timestamp}.txt", and "read"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "set-object-permission-error.txt"
✓ I call "{userStorage}" with "ReadObject" using arguments "{ResourceName}" and "test-object={Timestamp}.txt"
✓ "{result}" is an error | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service enforces uniform bucket-level access denial | |
| FAIL | Service supports bucket soft delete and recovery ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "CreateBucket" using argument "ccc-test-soft-delete"
✓ "{result}" is not an error
✓ I refer to "{result}" as "testBucket"
✓ I attach "{result}" to the test output as "created-bucket.json"
✓ I call "{storage}" with "DeleteBucket" using argument "ccc-test-soft-delete"
✓ "{result}" is not an error
✓ I call "{storage}" with "ListDeletedBuckets"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "deleted-buckets.json"
? "{result}" should have length greater than "0" (undefined)
⊘ I call "{storage}" with "RestoreBucket" using argument "ccc-test-soft-delete" (skipped)
⊘ "{result}" is not an error (skipped)
⊘ I call "{storage}" with "ListBuckets" (skipped)
⊘ "{result}" is not an error (skipped)
⊘ I attach "{result}" to the test output as "restored-buckets.json" (skipped)
⊘ I call "{storage}" with "DeleteBucket" using argument "ccc-test-soft-delete" (skipped)
⊘ "{result}" is not an error (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service supports bucket soft delete and recovery | |
| FAIL | Service prevents modification of locked retention policy ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "GetBucketRetentionDurationDays" using argument "{ResourceName}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "originalRetention"
✓ I attach "{result}" to the test output as "original-retention-days.txt"
✗ "{result}" should be greater than "0" - Error: expected {result} (0) to be greater than 0
⊘ I call "{storage}" with "SetBucketRetentionDurationDays" using arguments "{ResourceName}" and "1" (skipped)
⊘ "{result}" is an error (skipped)
⊘ I attach "{result}" to the test output as "set-retention-error.txt" (skipped)
⊘ I call "{storage}" with "GetBucketRetentionDurationDays" using argument "{ResourceName}" (skipped)
⊘ "{result}" is not an error (skipped)
? "{result}" should equal "{originalRetention}" (undefined) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents modification of locked retention policy | |
| FAIL | Service applies default retention policy to newly uploaded object ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-write", "{UID}", and "write"
✓ I refer to "{result}" as "testUserWrite"
✓ I attach "{result}" to the test output as "write-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserWrite}", and "{true}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "test-retention-object={Timestamp}.txt", and "protected data"
✓ I attach "{result}" to the test output as "uploaded-object.json"
✓ I call "{userStorage}" with "GetObjectRetentionDurationDays" using arguments "{ResourceName}" and "test-retention-object={Timestamp}.txt"
✗ "{result}" should be greater than "1" - Error: expected {result} (0) to be greater than 1 | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service applies default retention policy to newly uploaded object | |
| PASS | Service enforces retention policy on newly created objects ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "immediate-delete-test={Timestamp}.txt", and "test content"
✓ "{result}" is not an error
✓ I call "{storage}" with "DeleteObject" using arguments "{ResourceName}" and "immediate-delete-test={Timestamp}.txt"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "immediate-delete-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service enforces retention policy on newly created objects | |
| FAIL | Service validates retention period meets minimum requirements ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "retention-period-test={Timestamp}.txt", and "compliance data"
✓ I call "{storage}" with "GetObjectRetentionDurationDays" using arguments "{ResourceName}" and "retention-period-test={Timestamp}.txt"
✗ "{result}" should be greater than "1" - Error: expected {result} (0) to be greater than 1
⊘ I attach "{result}" to the test output as "retention-period-days.json" (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service validates retention period meets minimum requirements | |
| FAIL | Service prevents object deletion by write user during retention period ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-write", "{UID}", and "write"
✓ I refer to "{result}" as "testUserWrite"
✓ I attach "{result}" to the test output as "write-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserWrite}", and "{true}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "protected-object={Timestamp}.txt", and "immutable data"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "protected-object.json"
✓ I call "{userStorage}" with "DeleteObject" using arguments "{ResourceName}" and "protected-object={Timestamp}.txt"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "delete-protected-error.txt"
? "{result}" should contain one of "retention, locked, immutable, protected" (undefined) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents object deletion by write user during retention period | |
| PASS | Service prevents object deletion by admin user during retention period ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "admin-protected-object={Timestamp}.txt", and "compliance data"
✓ "{result}" is not an error
✓ I call "{storage}" with "DeleteObject" using arguments "{ResourceName}" and "admin-protected-object={Timestamp}.txt"
✓ "{result}" is an error
✓ I attach "{result}" to the test output as "admin-delete-protected-error.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents object deletion by admin user during retention period | |
| FAIL | Service prevents object modification during retention period ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-write", "{UID}", and "write"
✓ I refer to "{result}" as "testUserWrite"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserWrite}", and "{true}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "modify-test-object={Timestamp}.txt", and "original content"
✓ "{result}" is not an error
✓ I attach "{result}" to the test output as "original-object.json"
✓ I call "{userStorage}" with "CreateObject" using arguments "{ResourceName}", "modify-test-object={Timestamp}.txt", and "modified content"
✗ "{result}" is an error - Error: expected {result} to be an error, got *objstorage.Object
⊘ I attach "{result}" to the test output as "modify-protected-error.txt" (skipped)
? "{result}" should contain one of "retention, locked, immutable, protected, exists" (undefined) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service prevents object modification during retention period | |
| PASS | Service allows object read access during retention period ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{api}" with "GetServiceAPI" using argument "iam"
✓ I refer to "{result}" as "iamService"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "readable-protected-object={Timestamp}.txt", and "readable data"
✓ "{result}" is not an error
✓ I call "{iamService}" with "ProvisionUserWithAccess" using arguments "test-user-read", "{UID}", and "read"
✓ I refer to "{result}" as "testUserRead"
✓ I attach "{result}" to the test output as "read-user-identity.json"
✓ I call "{api}" with "GetServiceAPIWithIdentity" using arguments "object-storage", "{testUserRead}", and "{true}"
✓ "{result}" is not an error
✓ I refer to "{result}" as "userStorage"
✓ I call "{userStorage}" with "ReadObject" using arguments "{ResourceName}" and "readable-protected-object={Timestamp}.txt"
✓ "{result}" is not an error
✓ I refer to "{result}" as "readResult"
✓ I attach "{result}" to the test output as "read-protected-object.json"
✓ "{readResult.Name}" is "readable-protected-object={Timestamp}.txt" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service allows object read access during retention period | |
| FAIL | Service enables versioning and objects receive unique version identifiers ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "IsBucketVersioningEnabled" using argument "{ResourceName}"
✓ "{result}" is true
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "versioned-object.txt", and "test content"
✓ I refer to "{result}" as "createdObject"
? "{createdObject.VersionID}" is not empty (undefined)
⊘ I attach "{result}" to the test output as "versioned-object.json" (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Service enables versioning and objects receive unique version identifiers | |
| FAIL | Modified objects receive new version identifiers ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "version-test-object={Timestamp}.txt", and "original content"
✓ I refer to "{result.VersionID}" as "version1"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "version-test-object={Timestamp}.txt", and "modified content"
✓ I refer to "{result.VersionID}" as "version2"
? "{version1}" is not equal to "{version2}" (undefined) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Modified objects receive new version identifiers | |
| PASS | Modified objects receive new version identifiers ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "version-test-object={Timestamp}.txt", and "original content"
✓ I refer to "{result.VersionID}" as "version1"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "version-test-object={Timestamp}.txt", and "modified content"
✓ I refer to "{result.VersionID}" as "version2"
✓ I call "{storage}" with "ReadObjectAtVersion" using arguments "{ResourceName}", "version-test-object={Timestamp}.txt", and "{version1}"
✓ I attach "{result}" to the test output as "original-content.json"
✓ "{result.Data}" contains "original content"
✓ I call "{storage}" with "ReadObjectAtVersion" using arguments "{ResourceName}", "version-test-object={Timestamp}.txt", and "{version2}"
✓ "{result.Data}" contains "modified content"
✓ I attach "{result}" to the test output as "modified-content.json" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Modified objects receive new version identifiers | |
| PASS | Deleted object data can be reloaded from previous version ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "recover-deleted-object={Timestamp}.txt", and "data to retain"
✓ I refer to "{result.VersionID}" as "retainedVersionId"
✓ I call "{storage}" with "DeleteObject" using arguments "{ResourceName}" and "recover-deleted-object={Timestamp}.txt"
✓ I call "{storage}" with "ReadObjectAtVersion" using arguments "{ResourceName}", "recover-deleted-object={Timestamp}.txt", and "{retainedVersionId}"
✓ "{result.Data}" contains "data to retain"
✓ I attach "{result}" to the test output as "recovered-deleted-version.json" | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Deleted object data can be reloaded from previous version | |
| FAIL | Deleted object version remains in version list ✓ a cloud api for "{Instance}" in "api"
✓ I call "{api}" with "GetServiceAPI" using argument "object-storage"
✓ I refer to "{result}" as "storage"
✓ I call "{storage}" with "CreateObject" using arguments "{ResourceName}", "list-deleted-versions-object={Timestamp}.txt", and "versioned data"
✓ I refer to "{result.VersionID}" as "listedVersionId"
✓ I call "{storage}" with "DeleteObject" using arguments "{ResourceName}" and "list-deleted-versions-object={Timestamp}.txt"
✓ I call "{storage}" with "ListObjectVersions" using arguments "{ResourceName}" and "list-deleted-versions-object={Timestamp}.txt"
✗ "{result}" is an array of objects with at least the following contents - Error: field {result} is not an array
⊘ I attach "{result}" to the test output as "versions-after-delete.json" (skipped) | /subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t121838z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t121838z | object-storage | Deleted object version remains in version list |