🥒 CCC.SecMgmt Test: finos-ccc-integration-secret-main

Test Parameters

ServiceType	secrets
ProviderServiceType	Microsoft.KeyVault/vault/secrets
CatalogTypes	CCC.SecMgmt
TagFilter	@Behavioural, @secrets, @Behavioural
UID	finos-ccc-integration-secret-main
ResourceName	finos-ccc-integration-secret-main
Config	{}
authorized-region	westus2
azure-key-vault-name	finoscccintkvsec
azure-key-vault-uri	https://finoscccintkvsec.vault.azure.net/
azure-secret-name	finos-ccc-integration-secret-main
azure-subscription-id	c1cedd8e-bf91-4d7d-a4cc-45700402a2a1
azure-tenant-id	fa193ac0-9c06-4111-bf55-341e4db193d3
catalog-versions	{ "CCC.Core": "v2025.10", "CCC.SecMgmt": "DEV" }
permitted-regions	[ "westus2" ]
provider	azure
region	eastus
resource	finos-ccc-integration-secret-main
service	secrets
service-type	secrets
tags	@Behavioural @secrets
unauthorized-region	westeurope

Summary

Generated: 2026-06-16 16:33:08

Total Run Time: 21s

Features: 2

Scenarios: 4 (✅ 2 | ❌ 2)

Steps: 26 (✅ 21 | ❌ 2 | ⏭️ 3 | ❓ 0)

Filter by Tag:

Feature: CCC.SecMgmt.CN01.AR01 - Deny Outdated Secret Version After Rotation

Scenario: Current secret version is readable @CCC.SecMgmt @CCC.SecMgmt.CN01 @PerService @tlp-amber @tlp-red @Behavioural @secrets @SANITY @OPT_IN

Given a cloud api for "{config}" in "api"39µs

And I call "{api}" with "GetServiceAPI" using argument "secrets"106µs

And I refer to "{result}" as "svc"21µs

When I call "{svc}" with "RetrieveSecretVersion" using arguments "{uid}" and "latest"1s

Then "{result}" is not an error32µs

And I refer to "{result}" as "currentSecret"24µs

And I attach "{currentSecret}" to the test output as "Current Secret Version"61µs

Then "{currentSecret.Denied}" is "false"29µs

📎 Attachments:

Current Secret Version

View JSON (115 bytes)

{"Plaintext":"ccc-integration-secret-v2","VersionID":"27e2b4d65c9d4343b8d6acf8faa8bda6","Denied":false,"Reason":""}

Scenario: Stale secret version retrieve is denied @CCC.SecMgmt @CCC.SecMgmt.CN01 @PerService @tlp-amber @tlp-red @Behavioural @secrets @MAIN

Given a cloud api for "{config}" in "api"51µs

And I call "{api}" with "GetServiceAPI" using argument "secrets"41µs

And I refer to "{result}" as "svc"25µs

When I call "{svc}" with "RetrieveSecretVersion" using arguments "{uid}" and "{stale-version-id}"66ms

Then "{result}" is an error44µs

expected {result} to be an error, got *secrets.SecretValue

Feature: CCC.SecMgmt.CN02.AR01 - Deny Retrieve From Unauthorized Region

Scenario: Authorized region read succeeds @CCC.SecMgmt @CCC.SecMgmt.CN02 @PerService @tlp-amber @tlp-red @Behavioural @secrets @SANITY @OPT_IN

Given a cloud api for "{config}" in "api"51µs

And I call "{api}" with "GetServiceAPI" using argument "secrets"37µs

And I refer to "{result}" as "svc"26µs

When I call "{svc}" with "RetrieveSecretInRegion" using arguments "{uid}" and "{authorized-region}"10s

Then "{result}" is not an error34µs

expected {result} to not be an error, but got: access denied: Get "https://finos-ccc-integration-missing-westus2.vault.azure.net/secrets/finos-ccc-integration-secret-main/?api-version=2025-07-01": dial tcp: lookup finos-ccc-integration-missing-westus2.vault.azure.net on 127.0.0.53:53: no such host

And I refer to "{result}" as "authorizedRead"13µs

And I attach "{authorizedRead}" to the test output as "Authorized Region Read"18µs

Then "{authorizedRead.Denied}" is "false"23µs

Scenario: Unauthorized region read is denied @CCC.SecMgmt @CCC.SecMgmt.CN02 @PerService @tlp-amber @tlp-red @Behavioural @secrets @MAIN

Given a cloud api for "{config}" in "api"44µs

And I call "{api}" with "GetServiceAPI" using argument "secrets"36µs

And I refer to "{result}" as "svc"17µs

When I call "{svc}" with "RetrieveSecretInRegion" using arguments "{uid}" and "{unauthorized-region}"10s

Then "{result}" is an error27µs