service-name: azureStorageBehavioural
plugin-name: ccc-behavioural-plugin
plugin-uri: https://github.com/finos/common-cloud-controls
plugin-version: 0.0.0-dev
evaluation-suites:
- name: azureStorageBehavioural_CCC.ObjStor
  result: Failed
  catalog-id: CCC.ObjStor
  start-time: 2026-06-16 15:52:00.19394369 +0000 UTC m=+73.033082910
  end-time: 2026-06-16 15:52:00.193992354 +0000 UTC m=+73.033131574
  corrupted-state: false
  control-evaluations:
    metadata:
      id: ""
      type: Invalid
      gemara-version: ""
      description: ""
      author:
        id: ""
        name: ccc-behavioural-plugin
        type: Invalid
        version: 0.0.0-dev
        uri: https://github.com/finos/common-cloud-controls
    result: Not Run
    evaluations:
    - name: Prevent Requests to Buckets or Objects with Untrusted KMS Keys
      result: Failed
      message: Service allows reading bucket with read access
      control:
        reference-id: CCC.ObjStor
        entry-id: CCC.ObjStor.CN01
      assessment-logs:
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN01.AR01
        description: |
          Prevent any requests to object storage buckets or objects using
          untrusted KMS keys to protect against unauthorized data encryption,
          or sensitive data decryption.
        result: Failed
        message: Service allows reading bucket with read access
        applicability:
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        steps-executed: 2
        start: "2026-06-16T15:52:00Z"
        confidence-level: Medium
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN01.AR02
        description: |
          Prevent any requests to object storage buckets or objects using
          untrusted KMS keys to protect against unauthorized data encryption,
          or sensitive data decryption.
        result: Not Run
        message: ""
        applicability:
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        start: ""
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN01.AR03
        description: |
          Prevent any requests to object storage buckets or objects using
          untrusted KMS keys to protect against unauthorized data encryption,
          or sensitive data decryption.
        result: Not Run
        message: ""
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        start: ""
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN01.AR04
        description: |
          Prevent any requests to object storage buckets or objects using
          untrusted KMS keys to protect against unauthorized data encryption,
          or sensitive data decryption.
        result: Not Run
        message: ""
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        start: ""
    - name: Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy
      result: Failed
      message: Service supports bucket soft delete and recovery
      control:
        reference-id: CCC.ObjStor
        entry-id: CCC.ObjStor.CN03
      assessment-logs:
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN03.AR01
        description: |
          Ensure that object storage bucket is not deleted after creation,
          and that the preventative measure cannot be unset.
        result: Failed
        message: Service supports bucket soft delete and recovery
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        steps-executed: 1
        start: "2026-06-16T15:52:00Z"
        confidence-level: Medium
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN03.AR02
        description: |
          Ensure that object storage bucket is not deleted after creation,
          and that the preventative measure cannot be unset.
        result: Not Run
        message: ""
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        start: ""
    - name: Objects have an Effective Retention Policy by Default
      result: Failed
      message: Service applies default retention policy to newly uploaded object
      control:
        reference-id: CCC.ObjStor
        entry-id: CCC.ObjStor.CN04
      assessment-logs:
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN04.AR01
        description: |
          Ensure that all objects stored in the object storage system have a
          retention policy applied by default, preventing premature deletion
          or modification of objects.
        result: Failed
        message: Service applies default retention policy to newly uploaded object
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        steps-executed: 1
        start: "2026-06-16T15:52:00Z"
        confidence-level: Medium
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN04.AR02
        description: |
          Ensure that all objects stored in the object storage system have a
          retention policy applied by default, preventing premature deletion
          or modification of objects.
        result: Not Run
        message: ""
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        start: ""
    - name: Versioning is Enabled for All Objects in the Bucket
      result: Failed
      message: Service enables versioning and objects receive unique version identifiers
      control:
        reference-id: CCC.ObjStor
        entry-id: CCC.ObjStor.CN05
      assessment-logs:
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN05.AR01
        description: |
          Ensure that versioning is enabled for all objects stored in the object
          storage bucket to enable recovery of previous versions of objects in
          case of loss or corruption.
        result: Failed
        message: Service enables versioning and objects receive unique version identifiers
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        steps-executed: 1
        start: "2026-06-16T15:52:00Z"
        confidence-level: Medium
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN05.AR02
        description: |
          Ensure that versioning is enabled for all objects stored in the object
          storage bucket to enable recovery of previous versions of objects in
          case of loss or corruption.
        result: Not Run
        message: ""
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        start: ""
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN05.AR03
        description: |
          Ensure that versioning is enabled for all objects stored in the object
          storage bucket to enable recovery of previous versions of objects in
          case of loss or corruption.
        result: Not Run
        message: ""
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        start: ""
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN05.AR04
        description: |
          Ensure that versioning is enabled for all objects stored in the object
          storage bucket to enable recovery of previous versions of objects in
          case of loss or corruption.
        result: Not Run
        message: ""
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        start: ""
    - name: Multi-Factor Authentication Is Required for Object Deletion
      result: Not Run
      message: no Godog scenarios executed for CCC.ObjStor.CN07.AR03
      control:
        reference-id: CCC.ObjStor
        entry-id: CCC.ObjStor.CN07
      assessment-logs:
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN07.AR01
        description: |
          Ensure that deletion of objects stored in the object storage system is
          protected by multi-factor authentication (MFA), reducing the risk of
          accidental, unauthorized, or compromised-credential–based data destruction.
        result: Not Run
        message: no Godog scenarios executed for CCC.ObjStor.CN07.AR01
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.noGodogCoverageStep.func2
        steps-executed: 1
        start: "2026-06-16T15:52:00Z"
        end: "2026-06-16T15:52:00Z"
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN07.AR02
        description: |
          Ensure that deletion of objects stored in the object storage system is
          protected by multi-factor authentication (MFA), reducing the risk of
          accidental, unauthorized, or compromised-credential–based data destruction.
        result: Not Run
        message: no Godog scenarios executed for CCC.ObjStor.CN07.AR02
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.noGodogCoverageStep.func2
        steps-executed: 1
        start: "2026-06-16T15:52:00Z"
        end: "2026-06-16T15:52:00Z"
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN07.AR03
        description: |
          Ensure that deletion of objects stored in the object storage system is
          protected by multi-factor authentication (MFA), reducing the risk of
          accidental, unauthorized, or compromised-credential–based data destruction.
        result: Not Run
        message: no Godog scenarios executed for CCC.ObjStor.CN07.AR03
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.noGodogCoverageStep.func2
        steps-executed: 1
        start: "2026-06-16T15:52:00Z"
        end: "2026-06-16T15:52:00Z"
    - name: Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions
      result: Failed
      message: Service enforces uniform bucket-level access by rejecting object-level permissions
      control:
        reference-id: CCC.ObjStor
        entry-id: CCC.ObjStor.CN02
      assessment-logs:
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN02.AR01
        description: |
          Ensure that uniform bucket-level access is enforced across all
          object storage buckets. This prevents the use of ad-hoc or
          inconsistent object-level permissions, ensuring centralized,
          consistent, and secure access management in accordance with the
          principle of least privilege.
        result: Failed
        message: Service enforces uniform bucket-level access by rejecting object-level permissions
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        steps-executed: 1
        start: "2026-06-16T15:52:00Z"
        confidence-level: Medium
      - requirement:
          reference-id: ""
          entry-id: CCC.ObjStor.CN02.AR02
        description: |
          Ensure that uniform bucket-level access is enforced across all
          object storage buckets. This prevents the use of ad-hoc or
          inconsistent object-level permissions, ensuring centralized,
          consistent, and secure access management in accordance with the
          principle of least privilege.
        result: Not Run
        message: ""
        applicability:
        - tlp-clear
        - tlp-green
        - tlp-amber
        - tlp-red
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        start: ""
    target:
      id: ""
      name: ""
      type: Invalid
