🥒 CCC.SvlsComp Test: finos-ccc-integration-fn-main

Test Parameters

ServiceType	serverless-computing
ProviderServiceType	cloudfunctions.googleapis.com/Function
CatalogTypes	CCC.SvlsComp
TagFilter	@Behavioural, @serverless-computing, @Behavioural
UID	finos-ccc-integration-fn-main
ResourceName	finos-ccc-integration-fn-main
Config	{}
burst-overrun	15
catalog-versions	{ "CCC.Core": "v2025.10", "CCC.SvlsComp": "DEV" }
function-name	finos-ccc-integration-fn-main
gcp-project-id	nodal-time-474015-p5
permitted-regions	[ "us-central1" ]
private-endpoint-url	internal-only
provider	gcp
rate-limit-threshold	10
region	us-central1
resource	finos-ccc-integration-fn-main
service	serverless-computing
service-type	serverless-computing
tags	@Behavioural @serverless-computing

Summary

Generated: 2026-06-16 15:52:54

Total Run Time: 34s

Features: 12

Scenarios: 14 (✅ 7 | ❌ 7)

Steps: 105 (✅ 88 | ❌ 7 | ⏭️ 9 | ❓ 1)

Filter by Tag:

Feature: CCC.Core.CN02.AR01 - Encrypt Data For Storage

Scenario: Function encryption status reports enabled controls @CCC.Core @CCC.Core.CN02 @PerService @tlp-amber @tlp-green @tlp-red @Behavioural @serverless-computing

Given a cloud api for "{config}" in "api"43µs

Given I call "{api}" with "GetServiceAPI" using argument "serverless-computing"134µs

And I refer to "{result}" as "svc"17µs

When I call "{svc}" with "GetFunctionEncryptionStatus" using argument "{uid}"510ms

Then "{result}" is not an error27µs

And I refer to "{result}" as "encryption"24µs

And I attach "{encryption}" to the test output as "Function Encryption Status"46µs

Then "{encryption.EnvEncrypted}" is "true"37µs

expected {encryption.EnvEncrypted} to equal 'true', got 'false'

📎 Attachments:

Function Encryption Status

View JSON (62 bytes)

{"EnvEncrypted":false,"KMSKeyArn":"","SecretsEncrypted":false}

Feature: CCC.SvlsComp.CN01.AR01 - Deny Public Internet Access

Scenario: Private invoke path succeeds @CCC.SvlsComp @CCC.SvlsComp.CN01 @PerService @tlp-amber @tlp-red @Behavioural @serverless-computing @SANITY @OPT_IN

Given a cloud api for "{config}" in "api"39µs

And I call "{api}" with "GetServiceAPI" using argument "serverless-computing"29µs

And I refer to "{result}" as "svc"12µs

When I call "{svc}" with "AttemptPrivateInvoke" using argument "{uid}"49µs

Then "{result}" is not an error15µs

And I refer to "{result}" as "privateInvoke"14µs

Then "{privateInvoke.Invoked}" is "true"22µs

Scenario: No public invoke surface is configured @CCC.SvlsComp @CCC.SvlsComp.CN01 @PerService @tlp-amber @tlp-red @Behavioural @serverless-computing @MAIN

Given a cloud api for "{config}" in "api"38µs

And I call "{api}" with "GetServiceAPI" using argument "serverless-computing"29µs

And I refer to "{result}" as "svc"13µs

When I call "{svc}" with "GetInvokeEndpointExposure" using argument "{uid}"155ms

Then "{result}" is not an error27µs

And I refer to "{result}" as "exposure"17µs

And I attach "{exposure}" to the test output as "Invoke Endpoint Exposure"59µs

Then "{exposure.PublicEndpointConfigured}" is "false"38µs

📎 Attachments:

Invoke Endpoint Exposure

View JSON (127 bytes)

{"PublicEndpointConfigured":false,"PublicEndpointURL":"","PrivateEndpointConfigured":true,"PrivateEndpointURL":"internal-only"}

Scenario: Public internet invoke attempt is denied @CCC.SvlsComp @CCC.SvlsComp.CN01 @PerService @tlp-amber @tlp-red @Behavioural @serverless-computing @MAIN @OPT_IN

Given a cloud api for "{config}" in "api"42µs

And I call "{api}" with "GetServiceAPI" using argument "serverless-computing"32µs

And I refer to "{result}" as "svc"18µs

When I call "{svc}" with "AttemptPublicInternetInvoke" using argument "{uid}"158ms

Then "{result}" is not an error31µs

expected {result} to not be an error, but got: no public invoke URL available (set public-invoke-url or expose function with ALLOW_ALL ingress)

And I refer to "{result}" as "publicInvoke"13µs

And I attach "{publicInvoke}" to the test output as "Public Invoke Attempt"17µs

Then "{publicInvoke.AccessDenied}" is "true"19µs

Feature: CCC.SvlsComp.CN02.AR01 - Function Invocation Rate Limits

Scenario: Invocations beyond threshold are throttled @CCC.SvlsComp @CCC.SvlsComp.CN02 @PerService @tlp-amber @tlp-red @Behavioural @Destructive @serverless-computing

Given a cloud api for "{config}" in "api"36µs

And I call "{api}" with "GetServiceAPI" using argument "serverless-computing"25µs

And I refer to "{result}" as "svc"22µs

When I call "{svc}" with "InvokeFunctionBurst" using arguments "{uid}" and "{rate-limit-threshold}"117ms

Then "{result}" is not an error35µs

expected {result} to not be an error, but got: no invoke URL available for function

And I refer to "{result}" as "withinThreshold"13µs

Then "{withinThreshold.AllSucceeded}" is "true"17µs

When I call "{svc}" with "InvokeFunctionBurst" using arguments "{uid}" and "{burst-overrun}"16µs

Then "{result}" is not an error16µs

And I refer to "{result}" as "overrun"12µs

And I attach "{overrun}" to the test output as "Invocation Burst Overrun"13µs

Then "{overrun.ThrottledCount}" is greater than "{0}"24µs

Feature: CCC.Core.CN03.AR01 - Multi-Factor Authentication for Destructive Operations

Scenario: MFA requirement for destructive operations cannot be tested automatically @CCC.Core @CCC.Core.CN03 @PerService @tlp-amber @tlp-green @tlp-red @Behavioural @object-storage @load-balancer @virtual-machines @serverless-computing @NotTestable

Given a cloud api for "{config}" in "api"30µs

Then no-op required30µs

Feature: CCC.Core.CN04.AR01 - Log Administrative Access Attempts

Scenario: Verify admin actions are logged with identity and timestamp @CCC.Core @CCC.Core.CN04 @PerService @tlp-amber @tlp-clear @tlp-green @tlp-red @Behavioural @object-storage @virtual-machines @serverless-computing

Given a cloud api for "{config}" in "api"32µs

And I call "{api}" with "GetServiceAPI" using argument "{service-type}"35µs

And I refer to "{result}" as "theService"20µs

Given I call "{api}" with "GetServiceAPI" using argument "logging"924µs

And I refer to "{result}" as "loggingService"47µs

When I call "{theService}" with "UpdateResourcePolicy"999ms

Then "{result}" is not an error57µs

And I attach "{result}" to the test output as "Policy Update Result"41µs

And we wait for a period of "10000" ms10s

When I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "admin", and "{20}"794ms

Then "{result}" is not an error26µs

And I refer to "{result}" as "adminLogs"17µs

And I attach "{adminLogs}" to the test output as "Admin Activity Logs"94µs

Then "{adminLogs}" is an array of objects with at least the following contents271µs

result
Succeeded

expected row not found: map[result:Succeeded]

📎 Attachments:

Policy Update Result

View JSON (4 bytes)

null

Admin Activity Logs

View JSON (3773 bytes)

[{"resource":"cloud_run_revision","timestamp":"2026-06-16T15:41:35.837988Z","result":"Notice","fields":{"resource.configuration_name":"","resource.location":"us-central1","resource.project_id":"nodal-time-474015-p5","resource.revision_name":"","resource.service_name":"finos-ccc-integration-fn-main"}},{"resource":"cloud_function","timestamp":"2026-06-16T15:41:36.899953118Z","result":"Notice","fields":{"resource.function_name":"finos-ccc-integration-fn-main","resource.project_id":"nodal-time-474015-p5","resource.region":"us-central1"}},{"resource":"cloud_run_revision","timestamp":"2026-06-16T15:42:28.608816Z","result":"Notice","fields":{"resource.configuration_name":"","resource.location":"us-central1","resource.project_id":"nodal-time-474015-p5","resource.revision_name":"","resource.service_name":"finos-ccc-integration-fn-main"}},{"resource":"cloud_function","timestamp":"2026-06-16T15:42:35.722882664Z","result":"Notice","fields":{"resource.function_name":"finos-ccc-integration-fn-main","resource.project_id":"nodal-time-474015-p5","resource.region":"us-central1"}},{"resource":"cloud_run_revision","timestamp":"2026-06-16T15:43:11.053134Z","result":"Notice","fields":{"resource.configuration_name":"","resource.location":"us-central1","resource.project_id":"nodal-time-474015-p5","resource.revision_name":"","resource.service_name":"finos-ccc-integration-fn-main"}},{"resource":"cloud_function","timestamp":"2026-06-16T15:43:11.71071181Z","result":"Notice","fields":{"resource.function_name":"finos-ccc-integration-fn-main","resource.project_id":"nodal-time-474015-p5","resource.region":"us-central1"}},{"resource":"cloud_run_revision","timestamp":"2026-06-16T15:44:03.207825Z","result":"Notice","fields":{"resource.configuration_name":"","resource.location":"us-central1","resource.project_id":"nodal-time-474015-p5","resource.revision_name":"","resource.service_name":"finos-ccc-integration-fn-main"}},{"resource":"cloud_function","timestamp":"2026-06-16T15:44:10.525909691Z","result":"Notice","fields":{"resource.function_name":"finos-ccc-integration-fn-main","resource.project_id":"nodal-time-474015-p5","resource.region":"us-central1"}},{"resource":"cloud_run_revision","timestamp":"2026-06-16T15:51:26.545299Z","result":"Notice","fields":{"resource.configuration_name":"","resource.location":"us-central1","resource.project_id":"nodal-time-474015-p5","resource.revision_name":"","resource.service_name":"finos-ccc-integration-fn-main"}},{"resource":"cloud_function","timestamp":"2026-06-16T15:51:27.185600331Z","result":"Notice","fields":{"resource.function_name":"finos-ccc-integration-fn-main","resource.project_id":"nodal-time-474015-p5","resource.region":"us-central1"}},{"resource":"cloud_run_revision","timestamp":"2026-06-16T15:52:15.419852Z","result":"Notice","fields":{"resource.configuration_name":"","resource.location":"us-central1","resource.project_id":"nodal-time-474015-p5","resource.revision_name":"","resource.service_name":"finos-ccc-integration-fn-main"}},{"resource":"cloud_function","timestamp":"2026-06-16T15:52:23.335871343Z","result":"Notice","fields":{"resource.function_name":"finos-ccc-integration-fn-main","resource.project_id":"nodal-time-474015-p5","resource.region":"us-central1"}},{"resource":"cloud_run_revision","timestamp":"2026-06-16T15:52:55.399354Z","result":"Notice","fields":{"resource.configuration_name":"","resource.location":"us-central1","resource.project_id":"nodal-time-474015-p5","resource.revision_name":"","resource.service_name":"finos-ccc-integration-fn-main"}},{"resource":"cloud_function","timestamp":"2026-06-16T15:52:55.957052571Z","result":"Notice","fields":{"resource.function_name":"finos-ccc-integration-fn-main","resource.project_id":"nodal-time-474015-p5","resource.region":"us-central1"}}]

Feature: CCC.Core.CN04.AR02 - Log Data Modification Attempts

Scenario: Verify data modifications are logged with identity and timestamp @CCC.Core @CCC.Core.CN04 @PerService @tlp-amber @tlp-red @Behavioural @object-storage @virtual-machines @serverless-computing

Given a cloud api for "{config}" in "api"119µs

Given I call "{api}" with "GetServiceAPI" using argument "{service-type}"58µs

And I refer to "{result}" as "theService"181µs

And I call "{api}" with "GetServiceAPI" using argument "logging"32µs

And I refer to "{result}" as "loggingService"20µs

When I call "{theService}" with "TriggerDataWrite" using argument "{resource-name}"148ms

And I attach "{result}" to the test output as "Data Write Trigger Result"38µs

And we wait for a period of "10000" ms10s

Then I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "data-write", and "{20}"408ms

And I refer to "{result}" as "dataLogs"25µs

And I attach "{dataLogs}" to the test output as "Data Write Logs"35µs

Then "{dataLogs}" is an array of objects with at least the following contents29µs

result
Succeeded

expected row not found: map[result:Succeeded]

📎 Attachments:

Data Write Trigger Result

View JSON (4 bytes)

null

Data Write Logs

View JSON (2 bytes)

[]

Feature: CCC.Core.CN04.AR03 - Log Data Read Attempts

Scenario: Verify data read operations are logged with identity and timestamp @CCC.Core @CCC.Core.CN04 @PerService @tlp-red @Behavioural @object-storage @virtual-machines @serverless-computing

Given a cloud api for "{config}" in "api"36µs

Given I call "{api}" with "GetServiceAPI" using argument "{service-type}"36µs

And I refer to "{result}" as "theService"22µs

And I call "{api}" with "GetServiceAPI" using argument "logging"28µs

And I refer to "{result}" as "loggingService"24µs

When I call "{theService}" with "TriggerDataRead" using argument "{resource-name}"197ms

And I attach "{result}" to the test output as "Data Read Trigger Result"40µs

And we wait for a period of "10000" ms10s

When I call "{loggingService}" with "QueryLogs" using arguments "{resource-name}", "data-read", and "{20}"332ms

Then "{result}" is not an error26µs

And I refer to "{result}" as "readLogs"18µs

And I attach "{readLogs}" to the test output as "Data Read Logs"30µs

Then "{readLogs}" is an array of objects with at least the following contents27µs

result
Succeeded

expected row not found: map[result:Succeeded]

📎 Attachments:

Data Read Trigger Result

View JSON (4 bytes)

null

Data Read Logs

View JSON (2 bytes)

[]

Feature: CCC.Core.CN05.AR06 - Block All Unauthorized Requests

Scenario: Service prevents data read by user with no access @CCC.Core @CCC.Core.CN05 @PerService @tlp-amber @tlp-green @tlp-red @Destructive @Behavioural @object-storage @virtual-machines @serverless-computing

Given a cloud api for "{config}" in "api"30µs

And I call "{api}" with "GetServiceAPIWithIdentity" using arguments "{service-type}" and "test-user-no-access"175µs

And "{result}" is not an error41µs

And I refer to "{result}" as "userReadableService"20µs

When I call "{userReadableService}" with "TriggerDataRead" using argument "{resource-name}"284ms

Then "{result}" is an error25µs

And I attach "{result}" to the test output as "no-access-trigger-data-read-error.txt"33µs

📎 Attachments:

no-access-trigger-data-read-error.txt

View Content (296 bytes)

failed to get function "projects/nodal-time-474015-p5/locations/us-central1/functions/finos-ccc-integration-fn-main": googleapi: Error 403: Permission 'cloudfunctions.functions.get' denied on 'projects/nodal-time-474015-p5/locations/us-central1/functions/finos-ccc-integration-fn-main', forbidden

Feature: CCC.Core.CN07.AR01 - Publish Enumeration Activity Events

Scenario: Enumeration event publishing cannot be tested automatically @CCC.Core @CCC.Core.CN07 @PerService @tlp-amber @tlp-red @Behavioural @NotTestable @object-storage @virtual-machines @serverless-computing

Given a cloud api for "{config}" in "api"37µs

Then no-op required22µs

Feature: CCC.Core.CN07.AR02 - Log Enumeration Activities

Scenario: Enumeration logging cannot be verified automatically @CCC.Core @CCC.Core.CN07 @PerService @tlp-amber @tlp-clear @tlp-green @tlp-red @Behavioural @NotTestable @object-storage @virtual-machines @serverless-computing

Given a cloud api for "{config}" in "api"28µs

Then no-op required35µs

Feature: CCC.Core.CN10.AR01 - Replication Destination Trust

Scenario: Replication destination trust cannot be verified automatically @CCC.Core @CCC.Core.CN10 @PerService @tlp-amber @tlp-green @tlp-red @Behavioural @NotTestable @object-storage @virtual-machines @serverless-computing

Given a cloud api for "{config}" in "api"31µs

Then no-op required21µs

Feature: CCC.Core.CN06.AR01 - Resource Location Compliance

Scenario: Resource region can be retrieved for compliance verification @CCC.Core @CCC.Core.CN06 @PerService @tlp-amber @tlp-green @tlp-red @Behavioural @object-storage @vpc @virtual-machines @serverless-computing

Given a cloud api for "{config}" in "api"36µs

Given I call "{api}" with "GetServiceAPI" using argument "{service-type}"33µs

And I refer to "{result}" as "theService"21µs

When I call "{theService}" with "GetResourceRegion" using argument "{resource-name}"46µs

Then "{result}" is not an error25µs

And I refer to "{result}" as "region"19µs

And I attach "{region}" to the test output as "Resource Region"34µs

Then "{permitted-regions}" is an array of objects with at least the following contents53µs

value
{region}

expected row not found: map[value:{region}]

📎 Attachments:

Resource Region

View Content (11 bytes)

us-central1