CloudForge Core - Compliance Truth Tables

Compliance Frameworks

135

Parameterized Tests

1565

Total Test Cases

📊 Executive Summary

For Company Stakeholders & Leadership

1565

Compliance Scenarios Tested

Regulatory Frameworks Covered

135

Automated Test Suites

Compliance Validation Overview

CloudForge Core implements systematic automated testing to validate compliance with HIPAA, PCI-DSS, GDPR, and SOC2 requirements. Our testing infrastructure validates 1565 distinct configuration scenarios across all regulatory frameworks, ensuring that:

Compliant configurations pass validation - Systems configured according to regulatory requirements deploy successfully
Non-compliant configurations are detected - Systems with security gaps are identified before deployment
All regulatory controls are tested - Every compliance requirement has corresponding automated validation

Advanced Monitoring

Test Coverage: 67 scenarios

Compliant Paths: 30

Non-Compliant Paths: 37

44.8% scenarios validated

Database Security

Test Coverage: 84 scenarios

Compliant Paths: 32

Non-Compliant Paths: 52

38.1% scenarios validated

GDPR

Test Coverage: 235 scenarios

Compliant Paths: 78

Non-Compliant Paths: 157

33.2% scenarios validated

HIPAA

Test Coverage: 266 scenarios

Compliant Paths: 88

Non-Compliant Paths: 178

33.1% scenarios validated

Incident Response

Test Coverage: 99 scenarios

Compliant Paths: 37

Non-Compliant Paths: 62

37.4% scenarios validated

ISO 27001

Test Coverage: 3 scenarios

Compliant Paths: 2

Non-Compliant Paths: 1

66.7% scenarios validated

Key Management

Test Coverage: 67 scenarios

Compliant Paths: 23

Non-Compliant Paths: 44

34.3% scenarios validated

PCI-DSS

Test Coverage: 329 scenarios

Compliant Paths: 121

Non-Compliant Paths: 208

36.8% scenarios validated

SOC2

Test Coverage: 347 scenarios

Compliant Paths: 84

Non-Compliant Paths: 263

24.2% scenarios validated

Threat Protection

Test Coverage: 68 scenarios

Compliant Paths: 28

Non-Compliant Paths: 40

41.2% scenarios validated

Audit Readiness

This truth table report provides auditors with:

Complete test coverage matrix for all regulatory requirements
Documented validation logic for compliant vs non-compliant configurations
Automated evidence generation for compliance controls
Traceable mapping from requirements to test cases

📖 End-User Guide

For CloudForge Core Users

Understanding Compliance Validation

When you deploy infrastructure using CloudForge Core, automated compliance checks validate your configuration against regulatory requirements. This truth table shows all scenarios our system tests.

What This Means For You

Green Rows (✅ Compliant): These configurations meet regulatory requirements and will deploy successfully in ENFORCE mode.

Yellow Rows (⚠️ Non-Compliant): These configurations have compliance gaps and will either generate warnings (ADVISORY mode) or block deployment (ENFORCE mode).

Compliance Modes

Mode	Behavior	Use Case
`ADVISORY`	Logs warnings for compliance issues but allows deployment	Development environments, initial assessment
`ENFORCE`	Blocks deployment if compliance issues detected	Staging and production environments requiring certification

Security Profiles

Profile	Compliance Checks	Typical Usage
`DEV`	Minimal - most compliance checks skipped	Developer workstations, quick testing
`STAGING`	Moderate - core security controls enforced	Pre-production testing, integration environments
`PRODUCTION`	Full - all regulatory requirements validated	Customer-facing systems, regulated workloads

Common Configuration Flags

Encryption: ebsEncryptionEnabled, efsEncryptionAtRestEnabled, s3EncryptionEnabled
Logging: cloudTrailEnabled, flowLogsEnabled, albAccessLoggingEnabled
Monitoring: guardDutyEnabled, securityMonitoringEnabled, awsConfigEnabled
Network: networkMode (private-with-nat for compliance, public-no-nat for dev)
Authentication: authMode (alb-oidc, application-oidc, or none)

🔧 Developer - Technical Truth Tables

Complete test case matrices showing all parameter combinations and expected outcomes.

Advanced Monitoring

✅ Compliant: 30 ⚠️ Non-Compliant: 37 Total: 67

testAMExpandedSecurityHub

Test Cases: 14 Parameters: 7

profile	securityMonitoring	securityHubEnabled	pciDss	cis	awsFoundational	autoRemediation	Expected
PRODUCTION	true	false	false	false	false	false	⚠️ FAIL
PRODUCTION	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	false	true	false	false	false	false	⚠️ FAIL
PRODUCTION	false	true	true	false	false	false	⚠️ FAIL
PRODUCTION	false	true	false	true	false	false	⚠️ FAIL
PRODUCTION	false	true	false	false	true	false	⚠️ FAIL
PRODUCTION	false	true	true	true	false	false	✅ PASS
PRODUCTION	false	true	true	false	false	true	✅ PASS
PRODUCTION	true	true	true	true	true	true	✅ PASS
PRODUCTION	false	true	false	false	false	true	⚠️ FAIL
STAGING	false	false	false	false	false	false	⚠️ FAIL
STAGING	true	true	true	true	true	true	✅ PASS
DEV	false	false	false	false	false	false	⚠️ FAIL
DEV	true	true	true	false	false	false	✅ PASS

testAMExpandedInspector

Test Cases: 14 Parameters: 6

profile	securityMonitoring	inspectorEnabled	ec2Scanning	ecrScanning	continuousScanning	Expected
PRODUCTION	true	false	false	false	false	⚠️ FAIL
PRODUCTION	false	false	false	false	false	⚠️ FAIL
PRODUCTION	false	true	false	false	false	⚠️ FAIL
PRODUCTION	false	true	true	false	false	⚠️ FAIL
PRODUCTION	false	true	false	true	false	⚠️ FAIL
PRODUCTION	false	true	true	true	false	✅ PASS
PRODUCTION	false	true	true	true	true	✅ PASS
PRODUCTION	true	true	true	true	true	✅ PASS
PRODUCTION	false	true	false	false	true	⚠️ FAIL
PRODUCTION	true	true	false	false	false	⚠️ FAIL
STAGING	false	false	false	false	false	⚠️ FAIL
STAGING	true	true	true	true	true	✅ PASS
DEV	false	false	false	false	false	⚠️ FAIL
DEV	true	true	true	true	true	✅ PASS

testAMExpandedMacie

Test Cases: 15 Parameters: 4

profile	complianceFramework	macieEnabled	automatedDiscovery	Expected
PRODUCTION	GDPR	false	false	⚠️ FAIL
PRODUCTION	GDPR	true	false	✅ PASS
PRODUCTION	GDPR	true	true	✅ PASS
PRODUCTION	HIPAA	false	false	⚠️ FAIL
PRODUCTION	HIPAA	true	false	✅ PASS
PRODUCTION	HIPAA	true	true	✅ PASS
PRODUCTION	GDPR+HIPAA	true	true	✅ PASS
PRODUCTION	NONE	false	false	⚠️ FAIL
PRODUCTION	PCI-DSS	false	false	⚠️ FAIL
PRODUCTION	SOC2	false	false	⚠️ FAIL
PRODUCTION	NONE	true	true	✅ PASS
STAGING	GDPR	false	false	⚠️ FAIL
STAGING	GDPR	true	true	✅ PASS
DEV	HIPAA	false	false	⚠️ FAIL
DEV	GDPR	true	true	✅ PASS

testAMExpandedCentralizedMonitoring

Test Cases: 12 Parameters: 4

profile	securityMonitoring	complianceDashboard	securityAlerting	Expected
PRODUCTION	true	false	false	⚠️ FAIL
PRODUCTION	false	false	false	⚠️ FAIL
PRODUCTION	false	true	false	⚠️ FAIL
PRODUCTION	false	false	true	⚠️ FAIL
PRODUCTION	false	true	true	✅ PASS
PRODUCTION	true	true	true	✅ PASS
PRODUCTION	true	false	true	✅ PASS
PRODUCTION	true	true	false	✅ PASS
STAGING	false	false	false	⚠️ FAIL
STAGING	true	true	true	✅ PASS
DEV	false	false	false	⚠️ FAIL
DEV	true	true	true	✅ PASS

testAMExpandedComprehensiveScenarios

Test Cases: 12 Parameters: 15

profile	securityMonitoring	complianceFramework	securityHubEnabled	pciDss	awsFoundational	autoRemediation	inspectorEnabled	ec2Scanning	ecrScanning	continuousScanning	macieEnabled	automatedDiscovery	complianceDashboard	securityAlerting	Expected
PRODUCTION	true	GDPR	true	true	true	true	true	true	true	true	true	true	true	true	✅ PASS
PRODUCTION	false	GDPR	false	false	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	false	GDPR	true	true	false	false	false	false	false	false	false	true	true	false	⚠️ FAIL
PRODUCTION	false	GDPR	false	false	false	false	true	true	true	true	false	false	false	false	⚠️ FAIL
PRODUCTION	false	GDPR	false	false	false	false	false	false	false	false	true	true	false	false	⚠️ FAIL
PRODUCTION	false	PCI-DSS	true	true	true	true	true	true	true	true	false	false	true	true	✅ PASS
STAGING	true	GDPR	true	true	true	true	true	true	true	true	true	true	true	true	✅ PASS
STAGING	false	NONE	false	false	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
DEV	true	HIPAA	true	true	true	true	true	true	true	true	true	true	true	true	✅ PASS
DEV	false	NONE	false	false	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	true	NONE	false	false	false	false	true	true	true	true	false	false	true	true	✅ PASS
PRODUCTION	false	SOC2	true	true	true	true	true	true	true	true	false	false	false	false	✅ PASS

Database Security

✅ Compliant: 32 ⚠️ Non-Compliant: 52 Total: 84

testDBExpandedRDSSecurity

Test Cases: 16 Parameters: 7

profile	rdsEnabled	encryption	backup	multiAz	retentionDays	autoUpgrade	Expected
PRODUCTION	false	false	false	false	7	false	⚠️ FAIL
STAGING	false	false	false	false	7	false	⚠️ FAIL
DEV	false	false	false	false	7	false	⚠️ FAIL
PRODUCTION	true	false	false	false	7	false	⚠️ FAIL
PRODUCTION	true	true	false	false	7	false	⚠️ FAIL
PRODUCTION	true	false	true	false	7	false	⚠️ FAIL
PRODUCTION	true	true	true	false	7	false	✅ PASS
PRODUCTION	true	true	true	true	7	false	✅ PASS
PRODUCTION	true	true	true	true	7	true	✅ PASS
PRODUCTION	true	true	true	true	30	true	✅ PASS
PRODUCTION	true	true	true	true	3	true	✅ PASS
STAGING	true	false	false	false	7	false	⚠️ FAIL
STAGING	true	true	true	false	7	false	✅ PASS
STAGING	true	true	true	false	7	true	✅ PASS
DEV	true	false	false	false	7	false	⚠️ FAIL
DEV	true	true	true	true	7	true	✅ PASS

testDBExpandedDynamoDBSecurity

Test Cases: 12 Parameters: 4

profile	dynamoDbEnabled	encryption	pitr	Expected
PRODUCTION	false	false	false	⚠️ FAIL
STAGING	false	false	false	⚠️ FAIL
DEV	false	false	false	⚠️ FAIL
PRODUCTION	true	false	false	⚠️ FAIL
PRODUCTION	true	true	false	✅ PASS
PRODUCTION	true	false	true	✅ PASS
PRODUCTION	true	true	true	✅ PASS
STAGING	true	false	false	⚠️ FAIL
STAGING	true	true	false	✅ PASS
STAGING	true	true	true	✅ PASS
DEV	true	false	false	⚠️ FAIL
DEV	true	true	true	✅ PASS

testDBExpandedDatabaseMonitoring

Test Cases: 13 Parameters: 6

profile	rdsEnabled	activityStreams	performanceInsights	piEncrypted	enhancedMonitoring	Expected
PRODUCTION	false	false	false	false	false	⚠️ FAIL
STAGING	false	false	false	false	false	⚠️ FAIL
DEV	false	false	false	false	false	⚠️ FAIL
PRODUCTION	true	false	false	false	false	⚠️ FAIL
PRODUCTION	true	true	false	false	false	⚠️ FAIL
PRODUCTION	true	false	true	false	false	⚠️ FAIL
PRODUCTION	true	false	true	true	false	✅ PASS
PRODUCTION	true	false	false	false	true	⚠️ FAIL
PRODUCTION	true	true	true	true	true	✅ PASS
STAGING	true	false	false	false	false	⚠️ FAIL
STAGING	true	true	true	true	true	✅ PASS
DEV	true	false	false	false	false	⚠️ FAIL
DEV	true	true	true	true	true	✅ PASS

testDBExpandedComprehensiveScenarios

Test Cases: 12 Parameters: 14

profile	rdsEnabled	rdsEncryption	rdsBackup	multiAz	autoUpgrade	retentionDays	dynamoDbEnabled	dynamoDbEncryption	pitr	activityStreams	performanceInsights	piEncrypted	enhancedMonitoring	Expected
PRODUCTION	true	true	true	true	true	30	true	true	true	true	true	true	true	✅ PASS
PRODUCTION	true	true	false	false	false	7	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	true	true	true	true	true	14	true	false	false	true	true	true	true	✅ PASS
PRODUCTION	false	false	false	false	false	7	false	true	true	true	false	false	false	⚠️ FAIL
PRODUCTION	true	true	true	true	true	7	true	true	true	true	false	false	false	✅ PASS
STAGING	true	true	true	true	false	7	true	true	true	true	true	true	true	✅ PASS
STAGING	true	true	false	false	false	7	false	false	false	false	false	false	false	⚠️ FAIL
DEV	true	true	true	true	true	30	true	true	true	true	true	true	true	✅ PASS
DEV	true	true	false	false	false	1	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	true	true	true	false	true	7	true	true	true	false	false	false	false	✅ PASS
PRODUCTION	true	true	false	true	true	7	true	true	true	false	false	false	false	✅ PASS
PRODUCTION	true	true	true	true	true	7	true	true	true	true	false	false	false	✅ PASS

testRdsBackupRetentionEdgeCases

Test Cases: 11 Parameters: 6

profile	runtime	backupRetentionDays	rdsEnabled	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	7	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	6	true	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	35	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	1	true	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	0	true	ENFORCE	true	✅ PASS
PRODUCTION	EC2	7	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	3	true	ENFORCE	true	✅ PASS
STAGING	FARGATE	3	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	0	true	ENFORCE	false	⚠️ FAIL
DEV	FARGATE	0	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	1	true	ADVISORY	true	✅ PASS

testPerformanceInsightsEncryptionEdgeCases

Test Cases: 10 Parameters: 7

profile	runtime	rdsEnabled	performanceInsights	piEncrypted	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	true	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	true	true	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	false	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	false	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	true	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	true	true	false	ENFORCE	true	⚠️ FAIL
STAGING	FARGATE	true	true	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	true	true	false	ENFORCE	true	⚠️ FAIL
DEV	FARGATE	false	false	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	true	true	false	ADVISORY	true	✅ PASS

testRdsHighAvailabilityEdgeCases

Test Cases: 10 Parameters: 6

profile	runtime	multiAz	deleteProtection	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	true	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	true	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	false	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	false	false	ENFORCE	true	⚠️ FAIL
STAGING	FARGATE	true	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	false	ENFORCE	false	⚠️ FAIL
DEV	FARGATE	false	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	false	ADVISORY	false	⚠️ FAIL

GDPR

✅ Compliant: 78 ⚠️ Non-Compliant: 157 Total: 235

testGdprSecurityProfileBranches Art. 25

Test Cases: 6 Parameters: 3

profile	runtime	complianceMode	Expected
DEV	FARGATE	ADVISORY	✅ PASS
DEV	FARGATE	ENFORCE	✅ PASS
STAGING	FARGATE	ADVISORY	✅ PASS
STAGING	FARGATE	ENFORCE	✅ PASS
PRODUCTION	FARGATE	ADVISORY	✅ PASS
PRODUCTION	FARGATE	ENFORCE	✅ PASS

testGdprDataProtectionByDesignEncryption Art. 25

Test Cases: 12 Parameters: 6

profile	runtime	ebsEncryption	efsEncryption	s3Encryption	complianceMode	Expected
PRODUCTION	FARGATE	true	true	true	ENFORCE	✅ PASS
PRODUCTION	FARGATE	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	true	ADVISORY	✅ PASS
PRODUCTION	FARGATE	false	false	false	ADVISORY	⚠️ FAIL
STAGING	FARGATE	true	true	true	ENFORCE	✅ PASS
STAGING	FARGATE	false	false	false	ENFORCE	⚠️ FAIL

testGdprNetworkIsolation Art. 25

Test Cases: 6 Parameters: 4

profile	runtime	networkMode	complianceMode	Expected
PRODUCTION	FARGATE	public-no-nat	ENFORCE	✅ PASS
PRODUCTION	FARGATE	private-with-nat	ENFORCE	✅ PASS
STAGING	FARGATE	public-no-nat	ENFORCE	✅ PASS
STAGING	FARGATE	private-with-nat	ENFORCE	✅ PASS
PRODUCTION	FARGATE	public-no-nat	ADVISORY	✅ PASS
PRODUCTION	FARGATE	private-with-nat	ADVISORY	✅ PASS

testGdprProcessingRecordsLogging Art. 25

Test Cases: 12 Parameters: 6

profile	runtime	cloudTrail	flowLogs	albLogging	complianceMode	Expected
PRODUCTION	FARGATE	true	true	true	ENFORCE	✅ PASS
PRODUCTION	FARGATE	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	true	ADVISORY	✅ PASS
PRODUCTION	FARGATE	false	false	false	ADVISORY	⚠️ FAIL
STAGING	FARGATE	true	true	true	ENFORCE	✅ PASS
STAGING	FARGATE	false	false	false	ENFORCE	⚠️ FAIL

testGdprSecurityOfProcessingTransit Art. 25

Test Cases: 14 Parameters: 6

profile	runtime	hasCert	efsTransit	authMode	complianceMode	Expected
PRODUCTION	FARGATE	true	true	alb-oidc	ENFORCE	✅ PASS
PRODUCTION	FARGATE	true	true	jenkins-oidc	ENFORCE	✅ PASS
PRODUCTION	FARGATE	false	true	jenkins-oidc	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	true	none	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	false	alb-oidc	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	false	jenkins-oidc	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	none	ENFORCE	✅ PASS
PRODUCTION	FARGATE	false	true	none	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	false	none	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	false	none	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	alb-oidc	ADVISORY	✅ PASS
PRODUCTION	FARGATE	false	false	none	ADVISORY	⚠️ FAIL
STAGING	FARGATE	true	true	alb-oidc	ENFORCE	✅ PASS
STAGING	FARGATE	false	false	none	ENFORCE	⚠️ FAIL

testGdprSecurityMonitoringAndBackup Art. 25

Test Cases: 8 Parameters: 5

profile	runtime	securityMonitoring	automatedBackup	complianceMode	Expected
PRODUCTION	FARGATE	true	true	ENFORCE	✅ PASS
PRODUCTION	FARGATE	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	ADVISORY	✅ PASS
PRODUCTION	FARGATE	false	false	ADVISORY	⚠️ FAIL
STAGING	FARGATE	true	true	ENFORCE	✅ PASS
STAGING	FARGATE	false	false	ENFORCE	⚠️ FAIL

testGdprAwsConfig Art. 25

Test Cases: 6 Parameters: 4

profile	runtime	awsConfig	complianceMode	Expected
PRODUCTION	FARGATE	true	ENFORCE	✅ PASS
PRODUCTION	FARGATE	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	ADVISORY	✅ PASS
PRODUCTION	FARGATE	false	ADVISORY	⚠️ FAIL
STAGING	FARGATE	true	ENFORCE	✅ PASS
STAGING	FARGATE	false	ENFORCE	⚠️ FAIL

testGdprBreachDetection Art. 25

Test Cases: 8 Parameters: 5

profile	runtime	guardDuty	securityMonitoring	complianceMode	Expected
PRODUCTION	FARGATE	true	true	ENFORCE	✅ PASS
PRODUCTION	FARGATE	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	ADVISORY	✅ PASS
PRODUCTION	FARGATE	false	false	ADVISORY	⚠️ FAIL
STAGING	FARGATE	true	true	ENFORCE	✅ PASS
STAGING	FARGATE	false	false	ENFORCE	⚠️ FAIL

testGdprWafProtection Art. 25

Test Cases: 6 Parameters: 4

profile	runtime	wafEnabled	complianceMode	Expected
PRODUCTION	FARGATE	true	ENFORCE	✅ PASS
PRODUCTION	FARGATE	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	ADVISORY	✅ PASS
PRODUCTION	FARGATE	false	ADVISORY	⚠️ FAIL
STAGING	FARGATE	true	ENFORCE	✅ PASS
STAGING	FARGATE	false	ENFORCE	⚠️ FAIL

testGdprComprehensiveScenarios Art. 25

Test Cases: 8 Parameters: 12

profile	complianceMode	ebsEncryption	efsEncryption	s3Encryption	guardDuty	authMode	cloudTrail	flowLogs	securityMonitoring	waf	networkMode	Expected
PRODUCTION	ENFORCE	true	true	true	true	alb-oidc	true	true	true	true	private-with-nat	✅ PASS
PRODUCTION	ENFORCE	false	false	false	false	none	false	false	false	false	public-no-nat	⚠️ FAIL
PRODUCTION	ENFORCE	true	true	true	false	none	false	false	false	false	public-no-nat	⚠️ FAIL
PRODUCTION	ENFORCE	false	false	false	true	alb-oidc	true	true	true	true	private-with-nat	⚠️ FAIL
PRODUCTION	ADVISORY	true	true	true	true	alb-oidc	true	true	true	true	private-with-nat	✅ PASS
PRODUCTION	ADVISORY	false	false	false	false	none	false	false	false	false	public-no-nat	⚠️ FAIL
STAGING	ENFORCE	true	true	true	true	alb-oidc	true	true	true	true	private-with-nat	✅ PASS
STAGING	ENFORCE	false	false	false	false	none	false	false	false	false	public-no-nat	⚠️ FAIL

testGdprExpandedDataProtectionEncryption Art. 25

Test Cases: 23 Parameters: 6

profile	ebsEncryption	efsEncryption	s3Encryption	kmsRotation	complianceMode	Expected
PRODUCTION	true	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	true	ENFORCE	✅ PASS
STAGING	false	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	true	ADVISORY	✅ PASS
DEV	true	true	true	true	ENFORCE	✅ PASS
DEV	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	false	ADVISORY	⚠️ FAIL

testGdprExpandedAuditLoggingAndConfig Art. 25

Test Cases: 20 Parameters: 6

profile	cloudTrail	flowLogs	albLogging	awsConfig	complianceMode	Expected
PRODUCTION	true	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	true	ENFORCE	✅ PASS
STAGING	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	false	ADVISORY	⚠️ FAIL

testGdprExpandedSecurityMonitoringAndBreach Art. 25

Test Cases: 20 Parameters: 6

profile	secMonitoring	guardDuty	securityHub	waf	complianceMode	Expected
PRODUCTION	true	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	true	ENFORCE	✅ PASS
STAGING	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	false	ADVISORY	⚠️ FAIL

testGdprExpandedTransmissionSecurity Art. 25

Test Cases: 16 Parameters: 6

profile	hasCert	efsTransit	networkMode	authMode	complianceMode	Expected
PRODUCTION	true	true	private-with-nat	alb-oidc	ENFORCE	✅ PASS
PRODUCTION	true	true	private-with-nat	jenkins-oidc	ENFORCE	✅ PASS
PRODUCTION	true	true	private-with-nat	none	ENFORCE	✅ PASS
PRODUCTION	true	true	public-no-nat	alb-oidc	ENFORCE	✅ PASS
PRODUCTION	true	false	private-with-nat	alb-oidc	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	private-with-nat	jenkins-oidc	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	public-no-nat	none	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	private-with-nat	none	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	public-no-nat	none	ENFORCE	⚠️ FAIL
STAGING	true	true	private-with-nat	alb-oidc	ENFORCE	✅ PASS
STAGING	false	false	public-no-nat	none	ENFORCE	⚠️ FAIL
STAGING	true	true	private-with-nat	alb-oidc	ADVISORY	✅ PASS
DEV	true	true	private-with-nat	alb-oidc	ENFORCE	✅ PASS
DEV	false	false	public-no-nat	none	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	private-with-nat	alb-oidc	ADVISORY	✅ PASS
PRODUCTION	false	false	public-no-nat	none	ADVISORY	⚠️ FAIL

testGdprExpandedBackupAndAvailability Art. 25

Test Cases: 15 Parameters: 5

profile	automatedBackup	crossRegionBackup	pointInTimeRecovery	complianceMode	Expected
PRODUCTION	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	ENFORCE	✅ PASS
STAGING	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	ADVISORY	✅ PASS
DEV	true	true	true	ENFORCE	✅ PASS
DEV	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	ADVISORY	⚠️ FAIL

testGdprExpandedComprehensiveMultiArticle Art. 25

Test Cases: 16 Parameters: 17

profile	complianceMode	networkMode	authMode	ebsEnc	efsRestEnc	s3Enc	efsTransEnc	cloudTrail	flowLogs	albLogging	awsConfig	guardDuty	secMonitoring	waf	automatedBackup	crossRegion	Expected
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	true	true	✅ PASS
PRODUCTION	ENFORCE	public-no-nat	none	false	false	false	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	true	true	true	true	true	true	true	true	false	false	false	false	true	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	false	false	false	false	true	true	true	true	true	true	true	true	true	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	public-no-nat	none	true	true	true	true	true	true	true	true	true	true	true	true	true	✅ PASS
PRODUCTION	ENFORCE	private-with-nat	none	true	true	true	true	true	true	true	true	true	true	true	true	true	✅ PASS
STAGING	ENFORCE	private-with-nat	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	true	true	✅ PASS
STAGING	ENFORCE	public-no-nat	none	false	false	false	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
DEV	ENFORCE	public-no-nat	none	false	false	false	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ADVISORY	private-with-nat	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	true	true	✅ PASS
PRODUCTION	ADVISORY	public-no-nat	none	false	false	false	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	none	true	true	true	true	false	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	none	false	false	false	false	true	true	true	true	true	true	true	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	true	true	true	true	true	true	true	false	true	false	false	true	true	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	true	true	✅ PASS

testGdprDataResidencyEnforcement Art. 25

Test Cases: 10 Parameters: 5

profile	runtime	region	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	eu-west-1	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	eu-central-1	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	us-east-1	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	ap-southeast-1	ENFORCE	true	✅ PASS
PRODUCTION	EC2	eu-west-1	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	us-east-1	ENFORCE	true	✅ PASS
STAGING	FARGATE	eu-west-1	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	us-east-1	ENFORCE	true	✅ PASS
DEV	FARGATE	us-east-1	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	us-east-1	ADVISORY	false	⚠️ FAIL

testGdprEncryptionRequirements Art. 25

Test Cases: 10 Parameters: 8

profile	runtime	ebsEncryption	efsAtRest	efsTransit	s3Encryption	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	true	true	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	true	true	true	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	false	true	true	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	true	false	true	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	true	true	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	true	true	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	false	false	false	false	ENFORCE	true	⚠️ FAIL
STAGING	FARGATE	true	true	true	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	false	false	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	false	false	false	false	ADVISORY	false	⚠️ FAIL

testGdprAuditTrailRetention Art. 25

Test Cases: 10 Parameters: 5

profile	runtime	retentionDays	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	365	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	730	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	90	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	180	ENFORCE	true	✅ PASS
PRODUCTION	EC2	365	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	90	ENFORCE	true	✅ PASS
STAGING	FARGATE	365	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	90	ENFORCE	true	✅ PASS
DEV	FARGATE	7	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	90	ADVISORY	false	⚠️ FAIL

testGdprMultiViolationScenarios Art. 25

Test Cases: 9 Parameters: 7

profile	runtime	region	encryptionEnabled	retentionDays	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	us-east-1	false	90	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	eu-west-1	false	90	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	us-east-1	true	365	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	eu-west-1	false	365	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	eu-west-1	true	90	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	eu-west-1	true	365	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	eu-west-1	true	365	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	eu-west-1	true	365	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	us-east-1	false	90	ADVISORY	false	⚠️ FAIL

HIPAA

✅ Compliant: 88 ⚠️ Non-Compliant: 178 Total: 266

testHipaaSecurityManagementCombinations §164.308(a)

Test Cases: 7 Parameters: 5

profile	runtime	securityMonitoring	guardDuty	shouldEnforce	Expected
PRODUCTION	FARGATE	true	true	true	✅ PASS
PRODUCTION	FARGATE	false	true	true	✅ PASS
PRODUCTION	FARGATE	true	false	true	✅ PASS
PRODUCTION	FARGATE	false	false	true	⚠️ FAIL
STAGING	FARGATE	true	true	true	✅ PASS
STAGING	FARGATE	false	false	true	⚠️ FAIL
DEV	FARGATE	true	true	false	✅ PASS

testHipaaPhysicalSafeguardsCombinations §164.308(a)

Test Cases: 9 Parameters: 5

profile	runtime	automatedBackup	crossRegion	complianceMode	Expected
PRODUCTION	FARGATE	true	true	ENFORCE	✅ PASS
PRODUCTION	FARGATE	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	ADVISORY	✅ PASS
PRODUCTION	FARGATE	false	false	ADVISORY	⚠️ FAIL
STAGING	FARGATE	true	true	ENFORCE	✅ PASS
STAGING	FARGATE	false	true	ENFORCE	⚠️ FAIL
STAGING	FARGATE	true	false	ENFORCE	⚠️ FAIL

testHipaaAccessControlAuthModeCombinations §164.308(a)

Test Cases: 6 Parameters: 4

profile	runtime	authMode	complianceMode	Expected
PRODUCTION	FARGATE	none	ENFORCE	✅ PASS
PRODUCTION	FARGATE	alb-oidc	ENFORCE	✅ PASS
PRODUCTION	FARGATE	jenkins-oidc	ENFORCE	✅ PASS
PRODUCTION	FARGATE	none	ADVISORY	✅ PASS
STAGING	FARGATE	none	ENFORCE	✅ PASS
STAGING	FARGATE	alb-oidc	ENFORCE	✅ PASS

testHipaaAuditControlsCombinations §164.308(a)

Test Cases: 9 Parameters: 6

profile	runtime	cloudTrail	flowLogs	albLogging	complianceMode	Expected
PRODUCTION	FARGATE	true	true	true	ENFORCE	✅ PASS
PRODUCTION	FARGATE	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	true	ADVISORY	✅ PASS
PRODUCTION	FARGATE	false	false	false	ADVISORY	⚠️ FAIL
STAGING	FARGATE	true	true	true	ENFORCE	✅ PASS
STAGING	FARGATE	false	false	false	ENFORCE	⚠️ FAIL

testHipaaAuthenticationMfaCombinations §164.308(a)

Test Cases: 10 Parameters: 7

profile	authMode	cognitoMfa	cognitoAuto	hasSso	complianceMode	runtime	Expected
PRODUCTION	alb-oidc	true	true	false	ENFORCE	FARGATE	⚠️ FAIL
PRODUCTION	alb-oidc	false	true	false	ENFORCE	FARGATE	⚠️ FAIL
PRODUCTION	alb-oidc	true	false	false	ENFORCE	FARGATE	⚠️ FAIL
PRODUCTION	alb-oidc	false	false	true	ENFORCE	FARGATE	⚠️ FAIL
PRODUCTION	alb-oidc	false	false	false	ENFORCE	FARGATE	⚠️ FAIL
PRODUCTION	jenkins-oidc	true	true	false	ENFORCE	FARGATE	⚠️ FAIL
PRODUCTION	jenkins-oidc	false	false	true	ENFORCE	FARGATE	⚠️ FAIL
PRODUCTION	none	false	false	false	ENFORCE	FARGATE	⚠️ FAIL
STAGING	alb-oidc	true	true	false	ENFORCE	FARGATE	⚠️ FAIL
STAGING	alb-oidc	false	false	false	ENFORCE	FARGATE	⚠️ FAIL

testHipaaTransmissionSecurityCombinations §164.308(a)

Test Cases: 9 Parameters: 6

profile	hasCert	efsTransit	networkMode	complianceMode	runtime	Expected
PRODUCTION	true	true	private-with-nat	ENFORCE	FARGATE	✅ PASS
PRODUCTION	false	true	private-with-nat	ENFORCE	FARGATE	⚠️ FAIL
PRODUCTION	true	false	private-with-nat	ENFORCE	FARGATE	⚠️ FAIL
PRODUCTION	true	true	public-no-nat	ENFORCE	FARGATE	✅ PASS
PRODUCTION	false	false	public-no-nat	ENFORCE	FARGATE	⚠️ FAIL
PRODUCTION	true	true	private-with-nat	ADVISORY	FARGATE	✅ PASS
PRODUCTION	false	false	public-no-nat	ADVISORY	FARGATE	⚠️ FAIL
STAGING	true	true	private-with-nat	ENFORCE	FARGATE	✅ PASS
STAGING	false	false	public-no-nat	ENFORCE	FARGATE	⚠️ FAIL

testHipaaRetentionRequirementsCombinations §164.308(a)

Test Cases: 12 Parameters: 5

profile	retentionDays	complianceMode	shouldPass	runtime	Expected
PRODUCTION	2555	ENFORCE	true	FARGATE	✅ PASS
PRODUCTION	2190	ENFORCE	true	FARGATE	✅ PASS
PRODUCTION	1825	ENFORCE	false	FARGATE	⚠️ FAIL
PRODUCTION	1095	ENFORCE	false	FARGATE	⚠️ FAIL
PRODUCTION	730	ENFORCE	false	FARGATE	⚠️ FAIL
PRODUCTION	365	ENFORCE	false	FARGATE	⚠️ FAIL
PRODUCTION	180	ENFORCE	false	FARGATE	⚠️ FAIL
PRODUCTION	90	ENFORCE	false	FARGATE	⚠️ FAIL
PRODUCTION	365	ADVISORY	false	FARGATE	⚠️ FAIL
STAGING	2190	ENFORCE	true	FARGATE	✅ PASS
STAGING	730	ENFORCE	false	FARGATE	⚠️ FAIL
STAGING	365	ENFORCE	false	FARGATE	⚠️ FAIL

testHipaaSecurityProfileBranches §164.308(a)

Test Cases: 5 Parameters: 4

profile	complianceMode	shouldValidate	runtime	Expected
DEV	ADVISORY	false	FARGATE	⚠️ FAIL
STAGING	ADVISORY	true	FARGATE	✅ PASS
STAGING	ENFORCE	true	FARGATE	✅ PASS
PRODUCTION	ADVISORY	true	FARGATE	✅ PASS
PRODUCTION	ENFORCE	true	FARGATE	✅ PASS

testHipaaComprehensiveCombinations §164.308(a)

Test Cases: 8 Parameters: 13

profile	complianceMode	authMode	cognitoMfa	secMonitoring	guardDuty	cloudTrail	flowLogs	crossRegion	efsTransit	networkMode	retention	runtime	Expected
PRODUCTION	ENFORCE	alb-oidc	true	true	true	true	true	true	true	private-with-nat	2555	FARGATE	✅ PASS
STAGING	ENFORCE	alb-oidc	true	true	true	true	true	false	true	private-with-nat	2190	FARGATE	⚠️ FAIL
PRODUCTION	ADVISORY	none	false	false	false	false	false	false	false	public-no-nat	90	FARGATE	⚠️ FAIL
STAGING	ADVISORY	none	false	false	false	false	false	false	false	public-no-nat	90	FARGATE	⚠️ FAIL
PRODUCTION	ENFORCE	alb-oidc	true	true	false	true	false	false	true	private-with-nat	365	FARGATE	⚠️ FAIL
STAGING	ENFORCE	jenkins-oidc	true	false	true	false	true	false	false	private-with-nat	180	FARGATE	⚠️ FAIL
PRODUCTION	ENFORCE	alb-oidc	false	true	true	true	true	true	true	private-with-nat	2190	FARGATE	⚠️ FAIL
PRODUCTION	ENFORCE	jenkins-oidc	false	false	true	true	true	true	true	private-with-nat	2190	FARGATE	⚠️ FAIL

testHipaaExpandedSecurityManagement §164.308(a)

Test Cases: 14 Parameters: 5

profile	guardDuty	securityMonitoring	awsConfig	complianceMode	Expected
PRODUCTION	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	false	true	ENFORCE	⚠️ FAIL
STAGING	true	true	true	ENFORCE	✅ PASS
STAGING	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	ADVISORY	✅ PASS
PRODUCTION	true	false	false	ADVISORY	⚠️ FAIL
PRODUCTION	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	ENFORCE	⚠️ FAIL
STAGING	false	true	true	ENFORCE	⚠️ FAIL
STAGING	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	ADVISORY	⚠️ FAIL
PRODUCTION	false	false	false	ADVISORY	⚠️ FAIL
DEV	true	true	false	ENFORCE	⚠️ FAIL
DEV	false	false	false	ADVISORY	⚠️ FAIL

testHipaaExpandedEncryptionAtRest §164.308(a)

Test Cases: 22 Parameters: 5

profile	ebsEncryption	efsEncryption	s3Encryption	complianceMode	Expected
PRODUCTION	true	true	true	ENFORCE	✅ PASS
STAGING	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	ENFORCE	⚠️ FAIL
STAGING	true	true	false	ENFORCE	⚠️ FAIL
STAGING	true	false	true	ENFORCE	⚠️ FAIL
STAGING	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	ENFORCE	⚠️ FAIL
STAGING	true	false	false	ENFORCE	⚠️ FAIL
STAGING	false	true	false	ENFORCE	⚠️ FAIL
STAGING	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	ENFORCE	⚠️ FAIL
STAGING	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	ADVISORY	⚠️ FAIL
STAGING	true	true	true	ADVISORY	✅ PASS
STAGING	false	false	false	ADVISORY	⚠️ FAIL
DEV	false	false	false	ENFORCE	⚠️ FAIL
DEV	true	true	true	ADVISORY	✅ PASS

testHipaaExpandedAuditLogging §164.308(a)

Test Cases: 22 Parameters: 5

profile	cloudTrail	flowLogs	albLogging	complianceMode	Expected
PRODUCTION	true	true	true	ENFORCE	✅ PASS
STAGING	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	ENFORCE	⚠️ FAIL
STAGING	true	true	false	ENFORCE	⚠️ FAIL
STAGING	true	false	true	ENFORCE	⚠️ FAIL
STAGING	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	ENFORCE	⚠️ FAIL
STAGING	true	false	false	ENFORCE	⚠️ FAIL
STAGING	false	true	false	ENFORCE	⚠️ FAIL
STAGING	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	ENFORCE	⚠️ FAIL
STAGING	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	ADVISORY	⚠️ FAIL
STAGING	true	true	true	ADVISORY	✅ PASS
STAGING	false	false	false	ADVISORY	⚠️ FAIL
DEV	false	false	false	ENFORCE	⚠️ FAIL
DEV	true	true	true	ADVISORY	✅ PASS

testHipaaExpandedAuthentication §164.308(a)

Test Cases: 23 Parameters: 5

profile	authMode	cognitoMfa	identityCenterSso	complianceMode	Expected
PRODUCTION	alb-oidc	true	true	ENFORCE	✅ PASS
PRODUCTION	alb-oidc	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	false	false	ENFORCE	⚠️ FAIL
STAGING	alb-oidc	true	true	ENFORCE	✅ PASS
STAGING	alb-oidc	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	jenkins-oidc	true	true	ENFORCE	✅ PASS
PRODUCTION	jenkins-oidc	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	jenkins-oidc	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	jenkins-oidc	false	false	ENFORCE	⚠️ FAIL
STAGING	jenkins-oidc	true	true	ENFORCE	✅ PASS
STAGING	jenkins-oidc	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	none	true	true	ENFORCE	✅ PASS
PRODUCTION	none	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	none	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	none	false	false	ENFORCE	⚠️ FAIL
STAGING	none	true	true	ENFORCE	✅ PASS
STAGING	none	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	true	true	ADVISORY	✅ PASS
PRODUCTION	jenkins-oidc	false	false	ADVISORY	⚠️ FAIL
PRODUCTION	none	false	false	ADVISORY	⚠️ FAIL
DEV	none	false	false	ENFORCE	⚠️ FAIL
DEV	alb-oidc	true	true	ADVISORY	✅ PASS

testHipaaExpandedTransmissionSecurity §164.308(a)

Test Cases: 17 Parameters: 5

profile	hasCert	efsTransit	networkMode	complianceMode	Expected
PRODUCTION	true	true	private-with-nat	ENFORCE	✅ PASS
STAGING	true	true	private-with-nat	ENFORCE	✅ PASS
PRODUCTION	false	true	private-with-nat	ENFORCE	⚠️ FAIL
STAGING	false	true	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	private-with-nat	ENFORCE	⚠️ FAIL
STAGING	true	false	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	public-no-nat	ENFORCE	✅ PASS
STAGING	true	true	public-no-nat	ENFORCE	✅ PASS
PRODUCTION	false	false	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	public-no-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	public-no-nat	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	public-no-nat	ENFORCE	⚠️ FAIL
STAGING	false	false	public-no-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	private-with-nat	ADVISORY	✅ PASS
PRODUCTION	false	false	public-no-nat	ADVISORY	⚠️ FAIL
DEV	false	false	public-no-nat	ENFORCE	⚠️ FAIL
DEV	true	true	private-with-nat	ADVISORY	✅ PASS

testHipaaExpandedRetentionPeriods §164.308(a)

Test Cases: 17 Parameters: 3

profile	retentionDays	complianceMode	Expected
PRODUCTION	90	ENFORCE	✅ PASS
PRODUCTION	180	ENFORCE	✅ PASS
PRODUCTION	365	ENFORCE	✅ PASS
PRODUCTION	730	ENFORCE	✅ PASS
PRODUCTION	1095	ENFORCE	✅ PASS
PRODUCTION	2190	ENFORCE	✅ PASS
PRODUCTION	2555	ENFORCE	✅ PASS
STAGING	90	ENFORCE	✅ PASS
STAGING	365	ENFORCE	✅ PASS
STAGING	2190	ENFORCE	✅ PASS
STAGING	2555	ENFORCE	✅ PASS
PRODUCTION	90	ADVISORY	✅ PASS
PRODUCTION	2190	ADVISORY	✅ PASS
STAGING	90	ADVISORY	✅ PASS
STAGING	2190	ADVISORY	✅ PASS
DEV	90	ENFORCE	✅ PASS
DEV	2190	ADVISORY	✅ PASS

testHipaaExpandedPhysicalSafeguards §164.308(a)

Test Cases: 17 Parameters: 5

profile	automatedBackup	crossRegion	pointInTime	complianceMode	Expected
PRODUCTION	true	true	true	ENFORCE	✅ PASS
STAGING	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	false	false	ENFORCE	⚠️ FAIL
STAGING	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	ENFORCE	⚠️ FAIL
STAGING	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	ENFORCE	⚠️ FAIL
STAGING	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	ENFORCE	⚠️ FAIL
STAGING	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	ADVISORY	⚠️ FAIL
DEV	false	false	false	ENFORCE	⚠️ FAIL
DEV	true	true	true	ADVISORY	✅ PASS

testHipaaExpandedComprehensiveMultiRequirement §164.308(a)

Test Cases: 16 Parameters: 15

profile	complianceMode	ebsEnc	efsEnc	s3Enc	cloudTrail	flowLogs	albLogging	authMode	automatedBackup	crossRegion	guardDuty	secMonitoring	networkMode	retentionDays	Expected
PRODUCTION	ENFORCE	true	true	true	true	true	true	alb-oidc	true	true	true	true	private-with-nat	2190	✅ PASS
PRODUCTION	ENFORCE	false	false	false	false	false	false	none	false	false	false	false	public-no-nat	90	⚠️ FAIL
PRODUCTION	ENFORCE	true	true	true	false	false	false	none	false	false	false	false	public-no-nat	90	⚠️ FAIL
PRODUCTION	ENFORCE	false	false	false	true	true	true	none	false	false	false	false	public-no-nat	90	⚠️ FAIL
PRODUCTION	ENFORCE	false	false	false	false	false	false	alb-oidc	true	true	false	false	public-no-nat	90	⚠️ FAIL
PRODUCTION	ENFORCE	false	false	false	false	false	false	none	false	false	true	true	public-no-nat	90	⚠️ FAIL
PRODUCTION	ENFORCE	false	false	false	false	false	false	none	false	false	false	false	private-with-nat	90	⚠️ FAIL
PRODUCTION	ENFORCE	false	false	false	false	false	false	none	true	true	false	false	public-no-nat	90	⚠️ FAIL
PRODUCTION	ENFORCE	true	true	true	true	true	true	none	false	false	false	false	public-no-nat	90	⚠️ FAIL
PRODUCTION	ADVISORY	true	true	true	true	true	true	alb-oidc	true	true	true	true	private-with-nat	2190	✅ PASS
PRODUCTION	ADVISORY	false	false	false	false	false	false	none	false	false	false	false	public-no-nat	90	⚠️ FAIL
STAGING	ENFORCE	true	true	true	true	true	true	alb-oidc	true	true	true	true	private-with-nat	2190	✅ PASS
STAGING	ENFORCE	false	false	false	false	false	false	none	false	false	false	false	public-no-nat	90	⚠️ FAIL
PRODUCTION	ENFORCE	true	false	true	true	false	true	jenkins-oidc	true	false	true	false	private-with-nat	365	⚠️ FAIL
PRODUCTION	ENFORCE	false	true	false	false	true	false	alb-oidc	false	true	false	true	private-with-nat	1095	⚠️ FAIL
DEV	ENFORCE	false	false	false	false	false	false	none	false	false	false	false	public-no-nat	90	⚠️ FAIL

testHipaaFlowLogsEnforcement §164.308(a)

Test Cases: 9 Parameters: 5

profile	runtime	flowLogsEnabled	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	false	ENFORCE	true	⚠️ FAIL
STAGING	FARGATE	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	ENFORCE	false	⚠️ FAIL
STAGING	EC2	false	ENFORCE	false	⚠️ FAIL
DEV	FARGATE	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	ADVISORY	false	⚠️ FAIL

testHipaaEncryptionCombinations §164.308(a)

Test Cases: 10 Parameters: 8

profile	runtime	ebsEncryption	efsAtRest	efsTransit	s3Encryption	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	true	true	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	true	true	true	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	false	true	true	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	true	false	true	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	true	true	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	true	true	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	false	false	false	false	ENFORCE	true	⚠️ FAIL
STAGING	FARGATE	true	true	true	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	false	false	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	false	false	false	ADVISORY	false	⚠️ FAIL

testHipaaAuditLogRetention §164.308(a)

Test Cases: 14 Parameters: 5

profile	runtime	retentionDays	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	2190	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	2555	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	365	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	90	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	180	ENFORCE	true	✅ PASS
PRODUCTION	EC2	2190	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	365	ENFORCE	true	✅ PASS
STAGING	FARGATE	2190	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	90	ENFORCE	true	✅ PASS
STAGING	EC2	2190	ENFORCE	false	⚠️ FAIL
STAGING	EC2	30	ENFORCE	true	✅ PASS
DEV	FARGATE	2190	ENFORCE	false	⚠️ FAIL
DEV	FARGATE	7	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	90	ADVISORY	false	⚠️ FAIL

testHipaaMultiViolationScenarios §164.308(a)

Test Cases: 10 Parameters: 7

profile	runtime	flowLogsEnabled	encryptionEnabled	retentionDays	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	false	false	90	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	false	true	2190	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	false	2190	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	true	90	ENFORCE	true	✅ PASS
PRODUCTION	EC2	false	false	90	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	true	true	2190	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	false	2190	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	true	true	2190	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	true	true	90	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	false	false	90	ADVISORY	false	⚠️ FAIL

Incident Response

✅ Compliant: 37 ⚠️ Non-Compliant: 62 Total: 99

testIRExpandedIncidentResponsePlan

Test Cases: 15 Parameters: 7

profile	securityMonitoring	incidentPlanDoc	teamDefined	tested	gdpr	breachNotification72	Expected
PRODUCTION	true	false	false	false	false	false	⚠️ FAIL
PRODUCTION	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	false	true	false	false	false	false	⚠️ FAIL
PRODUCTION	false	true	true	false	false	false	⚠️ FAIL
PRODUCTION	false	true	true	true	false	false	✅ PASS
PRODUCTION	true	true	true	true	false	false	✅ PASS
PRODUCTION	false	false	false	false	true	false	⚠️ FAIL
PRODUCTION	false	false	false	false	true	true	⚠️ FAIL
PRODUCTION	false	true	true	true	true	true	✅ PASS
PRODUCTION	true	false	false	false	true	true	✅ PASS
STAGING	false	false	false	false	false	false	⚠️ FAIL
STAGING	true	true	true	true	false	false	✅ PASS
STAGING	false	false	false	false	true	false	⚠️ FAIL
DEV	false	false	false	false	false	false	⚠️ FAIL
DEV	true	true	true	true	true	true	✅ PASS

testIRExpandedDisasterRecovery

Test Cases: 14 Parameters: 7

profile	backupEnabled	crossRegion	drPlan	rtoRpoDefined	drTested	businessContinuity	Expected
PRODUCTION	true	true	false	false	false	false	⚠️ FAIL
PRODUCTION	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	true	false	false	false	false	false	⚠️ FAIL
PRODUCTION	true	true	true	false	false	false	✅ PASS
PRODUCTION	true	true	true	true	false	false	✅ PASS
PRODUCTION	true	true	true	true	true	false	✅ PASS
PRODUCTION	true	true	true	true	true	true	✅ PASS
PRODUCTION	true	true	false	false	false	true	✅ PASS
PRODUCTION	false	false	true	true	true	true	✅ PASS
PRODUCTION	true	false	true	true	true	true	✅ PASS
STAGING	false	false	false	false	false	false	⚠️ FAIL
STAGING	true	true	true	true	true	true	✅ PASS
DEV	false	false	false	false	false	false	⚠️ FAIL
DEV	true	true	true	true	true	true	✅ PASS

testIRExpandedBackupRestore

Test Cases: 11 Parameters: 4

profile	backupEnabled	crossRegion	restoreTested	Expected
PRODUCTION	true	true	false	✅ PASS
PRODUCTION	true	true	true	✅ PASS
PRODUCTION	true	false	false	⚠️ FAIL
PRODUCTION	true	false	true	✅ PASS
PRODUCTION	false	false	false	⚠️ FAIL
PRODUCTION	false	true	false	⚠️ FAIL
STAGING	true	true	false	✅ PASS
STAGING	true	true	true	✅ PASS
STAGING	false	false	false	⚠️ FAIL
DEV	true	true	true	✅ PASS
DEV	false	false	false	⚠️ FAIL

testIRExpandedForensicLogging

Test Cases: 14 Parameters: 7

profile	cloudTrail	logValidation	securityMonitoring	guardDuty	centralizedLogs	automatedReview	Expected
PRODUCTION	true	true	true	false	false	false	✅ PASS
PRODUCTION	true	false	true	false	false	false	⚠️ FAIL
PRODUCTION	true	true	true	true	false	false	✅ PASS
PRODUCTION	true	true	true	true	true	false	✅ PASS
PRODUCTION	true	true	true	true	true	true	✅ PASS
PRODUCTION	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	true	true	false	false	false	false	⚠️ FAIL
PRODUCTION	false	false	true	true	true	true	✅ PASS
PRODUCTION	true	true	true	false	false	true	✅ PASS
PRODUCTION	true	true	false	true	true	true	✅ PASS
STAGING	false	false	false	false	false	false	⚠️ FAIL
STAGING	true	true	true	true	true	true	✅ PASS
DEV	false	false	false	false	false	false	⚠️ FAIL
DEV	true	true	true	true	true	true	✅ PASS

testIRExpandedComprehensiveScenarios

Test Cases: 12 Parameters: 17

profile	securityMonitoring	incidentPlanDoc	teamDefined	irTested	businessContinuity	complianceFramework	breachNotification72	backupEnabled	crossRegion	drPlan	rtoRpoDefined	drTested	backupRestoreTested	cloudTrail	centralizedLogs	automatedReview	Expected
PRODUCTION	true	true	true	true	true	GDPR	true	true	true	true	true	true	true	true	true	true	✅ PASS
PRODUCTION	false	false	false	false	false	GDPR	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	false	false	false	false	false	NONE	false	true	true	true	true	true	true	false	false	false	⚠️ FAIL
PRODUCTION	true	true	true	true	true	NONE	false	false	false	false	false	false	false	true	true	true	✅ PASS
PRODUCTION	false	false	false	false	false	NONE	false	false	false	false	false	false	false	true	true	true	⚠️ FAIL
STAGING	true	true	true	true	true	GDPR	true	true	true	true	true	true	true	true	true	true	✅ PASS
STAGING	false	false	false	false	false	NONE	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
DEV	true	true	true	true	true	HIPAA	false	true	true	true	true	true	true	true	true	true	✅ PASS
DEV	false	false	false	false	false	NONE	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	true	true	true	true	true	PCI-DSS	false	true	true	true	true	true	true	true	true	true	✅ PASS
PRODUCTION	true	false	false	false	false	NONE	false	true	true	false	false	false	false	true	true	true	⚠️ FAIL
PRODUCTION	true	true	true	true	true	GDPR	true	false	false	true	true	true	true	false	false	false	✅ PASS

testIncidentResponseBackupEdgeCases

Test Cases: 10 Parameters: 7

profile	runtime	backupEnabled	crossRegion	retentionDays	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	true	true	7	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	true	false	7	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	true	7	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	true	true	1	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	true	true	35	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	true	true	7	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	false	false	0	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	true	false	3	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	false	0	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	false	0	ADVISORY	false	⚠️ FAIL

testIncidentResponseCloudTrailValidationEdgeCases

Test Cases: 7 Parameters: 5

profile	runtime	logValidationEnabled	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	false	ENFORCE	true	⚠️ FAIL
STAGING	FARGATE	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	ADVISORY	false	⚠️ FAIL

testIncidentResponseSnsAlertsEdgeCases

Test Cases: 7 Parameters: 5

profile	runtime	snsEnabled	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	false	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	true	ADVISORY	false	✅ PASS

testIncidentResponseMultiViolations

Test Cases: 9 Parameters: 6

profile	runtime	backupEnabled	logValidationEnabled	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	false	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	false	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	true	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	false	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	true	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	false	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	false	ADVISORY	false	⚠️ FAIL

ISO 27001

✅ Compliant: 2 ⚠️ Non-Compliant: 1 Total: 3

testIso27001ComplianceByProfile

Test Cases: 3 Parameters: 2

profile	rulesApply	Expected
PRODUCTION	true	✅ PASS
STAGING	true	✅ PASS
DEV	false	⚠️ FAIL

Key Management

✅ Compliant: 23 ⚠️ Non-Compliant: 44 Total: 67

testKMExpandedKMSKeyManagement

Test Cases: 8 Parameters: 3

profile	kmsRotation	customerManagedKeys	Expected
PRODUCTION	false	false	⚠️ FAIL
PRODUCTION	true	false	✅ PASS
PRODUCTION	false	true	✅ PASS
PRODUCTION	true	true	✅ PASS
STAGING	false	false	⚠️ FAIL
STAGING	true	true	✅ PASS
DEV	false	false	⚠️ FAIL
DEV	true	true	✅ PASS

testKMExpandedCertificateManagement

Test Cases: 8 Parameters: 3

profile	expirationMonitoring	acmAutoRenewal	Expected
PRODUCTION	false	false	⚠️ FAIL
PRODUCTION	true	false	✅ PASS
PRODUCTION	false	true	✅ PASS
PRODUCTION	true	true	✅ PASS
STAGING	false	false	⚠️ FAIL
STAGING	true	true	✅ PASS
DEV	false	false	⚠️ FAIL
DEV	true	true	✅ PASS

testKMExpandedSecretsManagement

Test Cases: 8 Parameters: 3

profile	secretsManager	secretRotation	Expected
PRODUCTION	false	false	⚠️ FAIL
PRODUCTION	true	false	✅ PASS
PRODUCTION	true	true	✅ PASS
STAGING	false	false	⚠️ FAIL
STAGING	true	false	✅ PASS
STAGING	true	true	✅ PASS
DEV	false	false	⚠️ FAIL
DEV	true	true	✅ PASS

testKMExpandedComprehensiveScenarios

Test Cases: 12 Parameters: 7

profile	kmsRotation	customerManagedKeys	certExpirationMonitoring	acmAutoRenewal	secretsManager	secretRotation	Expected
PRODUCTION	true	true	true	true	true	true	✅ PASS
PRODUCTION	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	true	true	false	false	false	false	⚠️ FAIL
PRODUCTION	false	false	true	true	false	false	⚠️ FAIL
PRODUCTION	false	false	false	false	true	true	⚠️ FAIL
STAGING	true	true	true	true	true	true	✅ PASS
STAGING	false	false	false	false	false	false	⚠️ FAIL
DEV	true	true	true	true	true	true	✅ PASS
DEV	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	true	true	false	false	true	true	✅ PASS
PRODUCTION	true	false	true	false	true	false	✅ PASS
PRODUCTION	true	true	false	true	false	false	✅ PASS

testKmsKeyRotationEdgeCases

Test Cases: 11 Parameters: 6

profile	runtime	rotationDays	kmsEnabled	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	365	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	366	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	730	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	90	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	0	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	365	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	400	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	365	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	730	true	ENFORCE	false	⚠️ FAIL
DEV	FARGATE	0	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	730	true	ADVISORY	false	✅ PASS

testCertificateManagementEdgeCases

Test Cases: 10 Parameters: 7

profile	runtime	expirationMonitoring	autoRenewal	warningDays	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	true	true	30	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	true	false	30	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	true	30	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	true	true	7	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	true	true	60	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	true	true	30	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	false	false	0	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	true	true	30	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	false	0	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	false	0	ADVISORY	false	⚠️ FAIL

testSecretsRotationEdgeCases

Test Cases: 10 Parameters: 6

profile	runtime	secretsManagerEnabled	rotationDays	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	true	30	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	true	7	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	true	90	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	true	0	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	false	0	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	true	30	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	false	0	ENFORCE	true	⚠️ FAIL
STAGING	FARGATE	true	90	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	0	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	0	ADVISORY	false	⚠️ FAIL

PCI-DSS

✅ Compliant: 121 ⚠️ Non-Compliant: 208 Total: 329

testPciDssEncryptionCombinations

Test Cases: 8 Parameters: 7

profile	runtime	ebsEncryption	efsAtRest	efsTransit	s3Encryption	complianceMode	Expected
PRODUCTION	FARGATE	true	true	true	true	ENFORCE	✅ PASS
PRODUCTION	FARGATE	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	true	true	ADVISORY	✅ PASS
PRODUCTION	FARGATE	false	false	false	false	ADVISORY	⚠️ FAIL

testPciDssAuditLoggingCombinations

Test Cases: 7 Parameters: 6

profile	runtime	cloudTrail	flowLogs	albLogging	complianceMode	Expected
PRODUCTION	FARGATE	true	true	true	ENFORCE	✅ PASS
PRODUCTION	FARGATE	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	true	ADVISORY	✅ PASS
PRODUCTION	FARGATE	false	false	false	ADVISORY	⚠️ FAIL

testPciDssSecurityMonitoringCombinations

Test Cases: 7 Parameters: 6

profile	runtime	guardDuty	secMonitoring	awsConfig	complianceMode	Expected
PRODUCTION	FARGATE	true	true	true	ENFORCE	✅ PASS
PRODUCTION	FARGATE	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	true	ADVISORY	✅ PASS
PRODUCTION	FARGATE	false	false	false	ADVISORY	⚠️ FAIL

testPciDssRetentionPeriods

Test Cases: 10 Parameters: 5

profile	runtime	days	complianceMode	sufficient	Expected
PRODUCTION	FARGATE	365	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	730	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	1095	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	1825	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	3650	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	30	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	90	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	180	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	30	ADVISORY	false	⚠️ FAIL
PRODUCTION	FARGATE	365	ADVISORY	true	✅ PASS

testPciDssVendorDefaultsCombinations

Test Cases: 5 Parameters: 5

profile	customConfig	hardening	servicesDisabled	minimalImage	Expected
PRODUCTION	false	false	false	false	⚠️ FAIL
STAGING	true	true	true	true	✅ PASS
STAGING	false	false	false	false	⚠️ FAIL
DEV	true	false	true	false	✅ PASS
DEV	false	false	false	false	⚠️ FAIL

testPciDssAuthenticationCombinations

Test Cases: 6 Parameters: 4

authMode	cognitoProvision	cognitoMfa	ssoArn	Expected
none	false	false	⚠️ FAIL
alb-oidc	true	true	✅ PASS
alb-oidc	false	false	arn:aws:sso:::instance/ssoins-123	⚠️ FAIL
jenkins-oidc	false	false	arn:aws:sso:::instance/ssoins-456	⚠️ FAIL
alb-oidc	false	false	⚠️ FAIL
jenkins-oidc	true	true	✅ PASS

testPciDssNetworkModes

Test Cases: 2 Parameters: 2

networkMode	shouldPass	Expected
private-with-nat	true	✅ PASS
public-no-nat	false	⚠️ FAIL

testPciDssComplianceModes

Test Cases: 2 Parameters: 1

complianceMode	Expected
ADVISORY	✅ PASS
ENFORCE	✅ PASS

testPciDssSecurityProfileBranches

Test Cases: 5 Parameters: 3

profile	complianceMode	shouldValidate	Expected
DEV	ADVISORY	false	⚠️ FAIL
STAGING	ADVISORY	false	⚠️ FAIL
STAGING	ENFORCE	false	⚠️ FAIL
PRODUCTION	ADVISORY	true	✅ PASS
PRODUCTION	ENFORCE	true	✅ PASS

testPciDssNetworkSecurityCombinations

Test Cases: 4 Parameters: 4

profile	runtime	networkMode	complianceMode	Expected
PRODUCTION	FARGATE	private-with-nat	ENFORCE	✅ PASS
PRODUCTION	FARGATE	public-no-nat	ENFORCE	✅ PASS
PRODUCTION	FARGATE	private-with-nat	ADVISORY	✅ PASS
PRODUCTION	FARGATE	public-no-nat	ADVISORY	✅ PASS

testPciDssEncryptionCombinations

Test Cases: 9 Parameters: 6

ebsEncryption	efsAtRest	s3Encryption	efsTransit	hasCert	complianceMode	Expected
true	true	true	true	true	ENFORCE	✅ PASS
false	true	true	true	true	ENFORCE	⚠️ FAIL
true	false	true	true	true	ENFORCE	⚠️ FAIL
true	true	false	true	true	ENFORCE	⚠️ FAIL
true	true	true	false	true	ENFORCE	⚠️ FAIL
true	true	true	true	false	ENFORCE	⚠️ FAIL
false	false	false	false	false	ENFORCE	⚠️ FAIL
true	true	true	true	true	ADVISORY	✅ PASS
false	false	false	false	false	ADVISORY	⚠️ FAIL

testPciDssWebApplicationSecurityCombinations

Test Cases: 4 Parameters: 2

wafEnabled	complianceMode	Expected
true	ENFORCE	✅ PASS
false	ENFORCE	⚠️ FAIL
true	ADVISORY	✅ PASS
false	ADVISORY	⚠️ FAIL

testPciDssAccessControlCombinations

Test Cases: 8 Parameters: 5

authMode	cognitoMfa	cognitoAuto	hasSso	complianceMode	Expected
none	false	false	false	ENFORCE	⚠️ FAIL
alb-oidc	true	true	false	ENFORCE	⚠️ FAIL
alb-oidc	false	false	false	ENFORCE	⚠️ FAIL
alb-oidc	false	false	true	ENFORCE	⚠️ FAIL
jenkins-oidc	true	true	false	ENFORCE	⚠️ FAIL
jenkins-oidc	false	false	true	ENFORCE	⚠️ FAIL
none	false	false	false	ADVISORY	⚠️ FAIL
alb-oidc	true	true	false	ADVISORY	✅ PASS

testPciDssAuditLoggingCombinations

Test Cases: 7 Parameters: 4

cloudTrail	flowLogs	albLogging	complianceMode	Expected
true	true	true	ENFORCE	✅ PASS
false	true	true	ENFORCE	⚠️ FAIL
true	false	true	ENFORCE	⚠️ FAIL
true	true	false	ENFORCE	⚠️ FAIL
false	false	false	ENFORCE	⚠️ FAIL
true	true	true	ADVISORY	✅ PASS
false	false	false	ADVISORY	⚠️ FAIL

testPciDssRetentionCombinations

Test Cases: 11 Parameters: 3

retentionDays	complianceMode	isCompliant	Expected
3650	ENFORCE	true	✅ PASS
2555	ENFORCE	true	✅ PASS
1825	ENFORCE	true	✅ PASS
1095	ENFORCE	true	✅ PASS
730	ENFORCE	true	✅ PASS
365	ENFORCE	true	✅ PASS
180	ENFORCE	false	⚠️ FAIL
90	ENFORCE	false	⚠️ FAIL
30	ENFORCE	false	⚠️ FAIL
365	ADVISORY	true	✅ PASS
90	ADVISORY	false	⚠️ FAIL

testPciDssSecurityMonitoringCombinations

Test Cases: 7 Parameters: 4

guardDuty	secMonitoring	awsConfig	complianceMode	Expected
true	true	true	ENFORCE	✅ PASS
false	true	true	ENFORCE	⚠️ FAIL
true	false	true	ENFORCE	⚠️ FAIL
true	true	false	ENFORCE	⚠️ FAIL
false	false	false	ENFORCE	⚠️ FAIL
true	true	true	ADVISORY	✅ PASS
false	false	false	ADVISORY	⚠️ FAIL

testPciDssVendorDefaultsCombinations

Test Cases: 9 Parameters: 6

customConfig	hardening	servicesDisabled	minimalImage	inventory	complianceMode	Expected
true	true	true	true	true	ENFORCE	✅ PASS
false	true	true	true	true	ENFORCE	⚠️ FAIL
true	false	true	true	true	ENFORCE	⚠️ FAIL
true	true	false	true	true	ENFORCE	⚠️ FAIL
true	true	true	false	true	ENFORCE	⚠️ FAIL
true	true	true	true	false	ENFORCE	⚠️ FAIL
false	false	false	false	false	ENFORCE	⚠️ FAIL
true	true	true	true	true	ADVISORY	✅ PASS
false	false	false	false	false	ADVISORY	⚠️ FAIL

testPciDssComprehensiveCombinations

Test Cases: 7 Parameters: 16

profile	complianceMode	networkMode	authMode	ebsEnc	efsRestEnc	s3Enc	efsTransEnc	hasCert	cloudTrail	flowLogs	albLogging	guardDuty	secMon	awsConfig	retention	Expected
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	365	✅ PASS
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	false	false	false	false	true	true	true	true	true	true	true	365	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	none	true	true	true	true	true	false	false	false	false	false	false	365	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	true	true	true	true	true	false	false	false	true	true	true	90	⚠️ FAIL
PRODUCTION	ENFORCE	public-no-nat	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	365	✅ PASS
PRODUCTION	ADVISORY	private-with-nat	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	365	✅ PASS
PRODUCTION	ADVISORY	public-no-nat	none	false	false	false	false	false	false	false	false	false	false	false	90	⚠️ FAIL

testPciDssExpandedEncryptionAtRest

Test Cases: 15 Parameters: 5

profile	ebsEncryption	efsEncryption	s3Encryption	complianceMode	Expected
PRODUCTION	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	ENFORCE	✅ PASS
STAGING	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	ADVISORY	✅ PASS
DEV	true	true	true	ENFORCE	✅ PASS
DEV	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	ADVISORY	⚠️ FAIL

testPciDssExpandedAuditLogging

Test Cases: 15 Parameters: 5

profile	cloudTrail	flowLogs	albLogging	complianceMode	Expected
PRODUCTION	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	ENFORCE	✅ PASS
STAGING	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	ADVISORY	✅ PASS
DEV	true	true	true	ENFORCE	✅ PASS
DEV	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	ADVISORY	⚠️ FAIL

testPciDssExpandedKeyManagement

Test Cases: 15 Parameters: 5

profile	kmsRotation	automatedBackup	crossRegionBackup	complianceMode	Expected
PRODUCTION	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	ENFORCE	✅ PASS
STAGING	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	false	ADVISORY	✅ PASS
DEV	true	true	true	ENFORCE	✅ PASS
DEV	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	ADVISORY	⚠️ FAIL

testPciDssExpandedAccessControl

Test Cases: 14 Parameters: 5

profile	authMode	cognitoMfa	identityCenterSso	complianceMode	Expected
PRODUCTION	alb-oidc	true	true	ENFORCE	✅ PASS
PRODUCTION	alb-oidc	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	jenkins-oidc	true	true	ENFORCE	✅ PASS
PRODUCTION	jenkins-oidc	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	none	false	false	ENFORCE	⚠️ FAIL
STAGING	alb-oidc	true	true	ENFORCE	✅ PASS
STAGING	none	false	false	ENFORCE	⚠️ FAIL
STAGING	alb-oidc	true	true	ADVISORY	✅ PASS
DEV	alb-oidc	true	true	ENFORCE	✅ PASS
DEV	none	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	true	true	ADVISORY	✅ PASS
PRODUCTION	none	false	false	ADVISORY	⚠️ FAIL

testPciDssExpandedNetworkSegmentation

Test Cases: 9 Parameters: 3

profile	networkMode	complianceMode	Expected
PRODUCTION	private-with-nat	ENFORCE	✅ PASS
PRODUCTION	public-no-nat	ENFORCE	✅ PASS
STAGING	private-with-nat	ENFORCE	✅ PASS
STAGING	public-no-nat	ENFORCE	✅ PASS
STAGING	private-with-nat	ADVISORY	✅ PASS
DEV	private-with-nat	ENFORCE	✅ PASS
DEV	public-no-nat	ENFORCE	✅ PASS
PRODUCTION	private-with-nat	ADVISORY	✅ PASS
PRODUCTION	public-no-nat	ADVISORY	✅ PASS

testPciDssExpandedRetentionPeriods

Test Cases: 15 Parameters: 3

profile	retentionDays	complianceMode	Expected
PRODUCTION	90	ENFORCE	✅ PASS
PRODUCTION	180	ENFORCE	✅ PASS
PRODUCTION	365	ENFORCE	✅ PASS
PRODUCTION	730	ENFORCE	✅ PASS
PRODUCTION	1095	ENFORCE	✅ PASS
PRODUCTION	2190	ENFORCE	✅ PASS
PRODUCTION	2555	ENFORCE	✅ PASS
STAGING	90	ENFORCE	✅ PASS
STAGING	365	ENFORCE	✅ PASS
STAGING	2190	ENFORCE	✅ PASS
STAGING	365	ADVISORY	✅ PASS
DEV	90	ENFORCE	✅ PASS
DEV	365	ENFORCE	✅ PASS
PRODUCTION	90	ADVISORY	✅ PASS
PRODUCTION	365	ADVISORY	✅ PASS

testPciDssExpandedVendorDefaultsAndDbSecurity

Test Cases: 15 Parameters: 5

profile	dbSecurity	kmsRotation	automatedBackup	complianceMode	Expected
PRODUCTION	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	ENFORCE	✅ PASS
STAGING	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	ADVISORY	✅ PASS
DEV	true	true	true	ENFORCE	✅ PASS
DEV	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	ADVISORY	⚠️ FAIL

testPciDssExpandedTransmissionSecurity

Test Cases: 15 Parameters: 5

profile	hasCert	efsTransit	networkMode	complianceMode	Expected
PRODUCTION	true	true	private-with-nat	ENFORCE	✅ PASS
PRODUCTION	true	true	public-no-nat	ENFORCE	✅ PASS
PRODUCTION	true	false	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	public-no-nat	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	public-no-nat	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	public-no-nat	ENFORCE	⚠️ FAIL
STAGING	true	true	private-with-nat	ENFORCE	✅ PASS
STAGING	false	false	public-no-nat	ENFORCE	⚠️ FAIL
STAGING	true	true	private-with-nat	ADVISORY	✅ PASS
DEV	true	true	private-with-nat	ENFORCE	✅ PASS
DEV	false	false	public-no-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	private-with-nat	ADVISORY	✅ PASS
PRODUCTION	false	false	public-no-nat	ADVISORY	⚠️ FAIL

testPciDssExpandedSystemMonitoring

Test Cases: 15 Parameters: 5

profile	secMonitoring	guardDuty	awsConfig	complianceMode	Expected
PRODUCTION	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	ENFORCE	✅ PASS
STAGING	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	ADVISORY	✅ PASS
DEV	true	true	true	ENFORCE	✅ PASS
DEV	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	ADVISORY	⚠️ FAIL

testPciDssExpandedComprehensiveMultiRequirement

Test Cases: 16 Parameters: 17

profile	complianceMode	networkMode	authMode	ebsEnc	efsRestEnc	s3Enc	efsTransEnc	hasCert	cloudTrail	flowLogs	albLogging	kmsRotation	automatedBackup	crossRegion	awsConfig	retentionDays	Expected
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	true	365	✅ PASS
PRODUCTION	ENFORCE	public-no-nat	none	false	false	false	false	false	false	false	false	false	false	false	false	90	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	false	false	false	false	true	true	true	true	true	true	true	true	365	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	none	true	true	true	true	true	true	true	true	false	false	false	false	365	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	true	true	true	true	true	false	false	false	true	true	true	true	90	⚠️ FAIL
PRODUCTION	ENFORCE	public-no-nat	none	true	true	true	false	false	true	true	true	true	true	true	true	365	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	true	true	true	true	true	true	true	true	false	false	false	true	365	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	false	365	⚠️ FAIL
STAGING	ENFORCE	private-with-nat	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	true	365	✅ PASS
STAGING	ENFORCE	public-no-nat	none	false	false	false	false	false	false	false	false	false	false	false	false	90	⚠️ FAIL
DEV	ENFORCE	public-no-nat	none	false	false	false	false	false	false	false	false	false	false	false	false	90	⚠️ FAIL
PRODUCTION	ADVISORY	private-with-nat	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	true	365	✅ PASS
PRODUCTION	ADVISORY	public-no-nat	none	false	false	false	false	false	false	false	false	false	false	false	false	90	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	none	true	true	true	true	true	true	true	true	false	false	true	true	365	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	false	false	false	false	true	true	true	true	true	true	true	true	365	⚠️ FAIL
PRODUCTION	ENFORCE	private-with-nat	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	true	2555	✅ PASS

testPciDssBackupAndDataProtection

Test Cases: 15 Parameters: 7

profile	backupEnabled	retentionDays	crossRegion	vaultLock	efsProtected	complianceMode	Expected
PRODUCTION	true	90	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	90	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	90	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	365	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	30	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	90	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	0	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	14	false	false	true	ENFORCE	⚠️ FAIL
STAGING	true	30	false	false	true	ENFORCE	⚠️ FAIL
STAGING	false	0	false	false	false	ENFORCE	⚠️ FAIL
DEV	false	0	false	false	false	ENFORCE	⚠️ FAIL
DEV	true	7	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	90	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	0	false	false	false	ADVISORY	⚠️ FAIL
STAGING	true	14	false	false	true	ADVISORY	✅ PASS

testPciDssWafEnforcementAcrossProfiles

Test Cases: 11 Parameters: 5

profile	runtime	wafEnabled	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	false	ENFORCE	true	⚠️ FAIL
STAGING	FARGATE	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	ENFORCE	false	⚠️ FAIL
STAGING	EC2	true	ENFORCE	false	⚠️ FAIL
STAGING	EC2	false	ENFORCE	false	⚠️ FAIL
DEV	FARGATE	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	ADVISORY	false	⚠️ FAIL
PRODUCTION	EC2	false	ADVISORY	false	⚠️ FAIL

testPciDssFlowLogsEnforcement

Test Cases: 9 Parameters: 5

profile	runtime	flowLogsEnabled	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	false	ENFORCE	true	⚠️ FAIL
STAGING	FARGATE	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	ENFORCE	false	⚠️ FAIL
STAGING	EC2	false	ENFORCE	false	⚠️ FAIL
DEV	FARGATE	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	ADVISORY	false	⚠️ FAIL

testPciDssLogRetentionRequirements

Test Cases: 12 Parameters: 5

profile	runtime	retentionDays	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	365	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	730	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	90	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	180	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	0	ENFORCE	true	✅ PASS
PRODUCTION	EC2	365	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	90	ENFORCE	true	✅ PASS
STAGING	FARGATE	90	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	14	ENFORCE	false	⚠️ FAIL
STAGING	EC2	30	ENFORCE	false	⚠️ FAIL
DEV	FARGATE	7	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	90	ADVISORY	false	⚠️ FAIL

testPciDssAcrossApplicationTypes

Test Cases: 11 Parameters: 7

profile	runtime	topology	flowLogsEnabled	wafEnabled	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	JENKINS_SERVICE	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	JENKINS_SERVICE	true	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	JENKINS_SERVICE	false	true	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	APPLICATION_SERVICE	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	APPLICATION_SERVICE	false	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	APPLICATION_SERVICE	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	APPLICATION_SERVICE	true	false	ENFORCE	true	⚠️ FAIL
STAGING	FARGATE	JENKINS_SERVICE	false	false	ENFORCE	false	⚠️ FAIL
STAGING	EC2	APPLICATION_SERVICE	true	true	ENFORCE	false	⚠️ FAIL
DEV	FARGATE	APPLICATION_SERVICE	false	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	JENKINS_SERVICE	false	false	ADVISORY	false	⚠️ FAIL

testPciDssMultiViolationScenarios

Test Cases: 9 Parameters: 7

profile	runtime	wafEnabled	flowLogsEnabled	retentionDays	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	false	false	90	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	false	true	365	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	false	365	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	true	90	ENFORCE	true	✅ PASS
PRODUCTION	EC2	false	false	90	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	true	true	365	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	false	14	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	true	true	90	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	false	90	ADVISORY	false	⚠️ FAIL

SOC2

✅ Compliant: 84 ⚠️ Non-Compliant: 263 Total: 347

testSoc2SecurityProfileBranches

Test Cases: 6 Parameters: 3

profile	complianceMode	shouldValidate	Expected
DEV	ADVISORY	false	⚠️ FAIL
DEV	ENFORCE	false	⚠️ FAIL
STAGING	ADVISORY	true	✅ PASS
STAGING	ENFORCE	true	✅ PASS
PRODUCTION	ADVISORY	true	✅ PASS
PRODUCTION	ENFORCE	true	✅ PASS

testSoc2AccessControls

Test Cases: 8 Parameters: 4

authMode	ebsEncryption	efsEncryption	complianceMode	Expected
alb-oidc	true	true	ENFORCE	✅ PASS
none	true	true	ENFORCE	✅ PASS
alb-oidc	false	true	ENFORCE	⚠️ FAIL
alb-oidc	true	false	ENFORCE	⚠️ FAIL
alb-oidc	false	false	ENFORCE	⚠️ FAIL
none	false	false	ENFORCE	⚠️ FAIL
alb-oidc	true	true	ADVISORY	✅ PASS
none	false	false	ADVISORY	⚠️ FAIL

testSoc2NetworkSecurity

Test Cases: 10 Parameters: 4

hasCert	efsTransit	waf	complianceMode	Expected
true	true	true	ENFORCE	✅ PASS
false	true	true	ENFORCE	⚠️ FAIL
true	false	true	ENFORCE	⚠️ FAIL
true	true	false	ENFORCE	⚠️ FAIL
false	false	true	ENFORCE	⚠️ FAIL
false	true	false	ENFORCE	⚠️ FAIL
true	false	false	ENFORCE	⚠️ FAIL
false	false	false	ENFORCE	⚠️ FAIL
true	true	true	ADVISORY	✅ PASS
false	false	false	ADVISORY	⚠️ FAIL

testSoc2SystemMonitoring

Test Cases: 11 Parameters: 6

secMonitoring	guardDuty	cloudTrail	flowLogs	awsConfig	complianceMode	Expected
true	true	true	true	true	ENFORCE	✅ PASS
false	true	true	true	true	ENFORCE	⚠️ FAIL
true	false	true	true	true	ENFORCE	⚠️ FAIL
true	true	false	true	true	ENFORCE	⚠️ FAIL
true	true	true	false	true	ENFORCE	⚠️ FAIL
true	true	true	true	false	ENFORCE	⚠️ FAIL
false	false	true	true	true	ENFORCE	⚠️ FAIL
true	true	false	false	false	ENFORCE	⚠️ FAIL
false	false	false	false	false	ENFORCE	⚠️ FAIL
true	true	true	true	true	ADVISORY	✅ PASS
false	false	false	false	false	ADVISORY	⚠️ FAIL

testSoc2ChangeManagement

Test Cases: 6 Parameters: 3

cloudTrail	awsConfig	complianceMode	Expected
true	true	ENFORCE	✅ PASS
false	true	ENFORCE	⚠️ FAIL
true	false	ENFORCE	⚠️ FAIL
false	false	ENFORCE	⚠️ FAIL
true	true	ADVISORY	✅ PASS
false	false	ADVISORY	⚠️ FAIL

testSoc2Availability

Test Cases: 10 Parameters: 6

profile	multiAz	autoScaling	backup	crossRegion	complianceMode	Expected
PRODUCTION	true	true	true	true	ENFORCE	✅ PASS
PRODUCTION	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	false	ADVISORY	⚠️ FAIL
STAGING	true	true	true	true	ENFORCE	✅ PASS
STAGING	false	false	false	false	ENFORCE	⚠️ FAIL

testSoc2Confidentiality

Test Cases: 10 Parameters: 5

ebsEncryption	efsEncryption	s3Encryption	networkMode	complianceMode	Expected
true	true	true	private-with-nat	ENFORCE	✅ PASS
false	true	true	private-with-nat	ENFORCE	⚠️ FAIL
true	false	true	private-with-nat	ENFORCE	⚠️ FAIL
true	true	false	private-with-nat	ENFORCE	⚠️ FAIL
true	true	true	public-no-nat	ENFORCE	✅ PASS
false	false	true	private-with-nat	ENFORCE	⚠️ FAIL
true	true	true	public-no-nat	ENFORCE	✅ PASS
false	false	false	public-no-nat	ENFORCE	⚠️ FAIL
true	true	true	private-with-nat	ADVISORY	✅ PASS
false	false	false	public-no-nat	ADVISORY	⚠️ FAIL

testSoc2ComprehensiveScenarios

Test Cases: 5 Parameters: 16

profile	complianceMode	authMode	ebsEncryption	efsEncryption	s3Encryption	efsTransit	waf	secMonitoring	guardDuty	cloudTrail	flowLogs	awsConfig	multiAz	autoScaling	networkMode	Expected
PRODUCTION	ENFORCE	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	true	private-with-nat	✅ PASS
PRODUCTION	ENFORCE	alb-oidc	true	true	true	true	true	false	false	false	false	false	true	true	private-with-nat	⚠️ FAIL
PRODUCTION	ADVISORY	alb-oidc	true	true	true	true	true	true	true	true	true	true	true	true	private-with-nat	✅ PASS
PRODUCTION	ADVISORY	none	false	false	false	false	false	false	false	false	false	false	false	false	public-no-nat	⚠️ FAIL
STAGING	ENFORCE	alb-oidc	true	true	true	true	true	false	true	true	true	true	false	false	private-with-nat	⚠️ FAIL

testSoc2ExpandedLogicalAccessControls

Test Cases: 23 Parameters: 7

profile	authMode	ebsEncryption	efsEncryption	s3Encryption	kmsRotation	complianceMode	Expected
PRODUCTION	alb-oidc	true	true	true	true	ENFORCE	✅ PASS
PRODUCTION	none	true	true	true	true	ENFORCE	✅ PASS
PRODUCTION	alb-oidc	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	true	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	true	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	true	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	none	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	none	true	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	none	true	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	none	true	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	false	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	false	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	true	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	false	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	true	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	none	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	none	false	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	false	false	false	false	ENFORCE	⚠️ FAIL
STAGING	alb-oidc	true	true	true	true	ENFORCE	✅ PASS
STAGING	none	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	alb-oidc	true	true	true	true	ADVISORY	✅ PASS
PRODUCTION	none	false	false	false	false	ADVISORY	⚠️ FAIL
STAGING	none	false	false	false	false	ADVISORY	⚠️ FAIL

testSoc2ExpandedSystemMonitoring

Test Cases: 23 Parameters: 8

profile	secMonitoring	guardDuty	securityHub	cloudTrail	flowLogs	albLogging	complianceMode	Expected
PRODUCTION	true	true	true	true	true	true	ENFORCE	✅ PASS
PRODUCTION	false	true	true	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	true	true	true	ENFORCE	⚠️ FAIL
STAGING	true	true	true	true	true	true	ENFORCE	✅ PASS
STAGING	false	false	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	false	false	false	ADVISORY	⚠️ FAIL

testSoc2ExpandedAvailability

Test Cases: 20 Parameters: 7

profile	multiAz	autoScaling	automatedBackup	crossRegionBackup	pitr	complianceMode	Expected
PRODUCTION	true	true	true	true	true	ENFORCE	✅ PASS
PRODUCTION	false	true	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	false	true	ENFORCE	⚠️ FAIL
STAGING	true	true	true	true	true	ENFORCE	✅ PASS
STAGING	false	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	false	false	ADVISORY	⚠️ FAIL

testSoc2ExpandedConfidentiality

Test Cases: 18 Parameters: 7

profile	ebsEncryption	efsEncryption	s3Encryption	efsTransit	networkMode	complianceMode	Expected
PRODUCTION	true	true	true	true	private-with-nat	ENFORCE	✅ PASS
PRODUCTION	false	true	true	true	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	true	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	true	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	false	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	public-no-nat	ENFORCE	✅ PASS
PRODUCTION	false	false	true	true	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	true	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	true	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	true	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	false	public-no-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	public-no-nat	ENFORCE	✅ PASS
PRODUCTION	false	false	false	false	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	public-no-nat	ENFORCE	⚠️ FAIL
STAGING	true	true	true	true	private-with-nat	ENFORCE	✅ PASS
STAGING	false	false	false	false	public-no-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	private-with-nat	ADVISORY	✅ PASS
PRODUCTION	false	false	false	false	public-no-nat	ADVISORY	⚠️ FAIL

testSoc2ExpandedChangeManagementAndRisk

Test Cases: 17 Parameters: 6

profile	cloudTrail	awsConfig	guardDuty	securityHub	complianceMode	Expected
PRODUCTION	true	true	true	true	ENFORCE	✅ PASS
PRODUCTION	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	true	ENFORCE	⚠️ FAIL
STAGING	true	true	true	true	ENFORCE	✅ PASS
STAGING	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	false	ADVISORY	⚠️ FAIL

testSoc2ExpandedComprehensiveMultiCriteria

Test Cases: 24 Parameters: 20

profile	complianceMode	authMode	networkMode	ebsEncryption	efsEncryption	s3Encryption	efsTransit	secMonitoring	guardDuty	cloudTrail	flowLogs	awsConfig	multiAz	autoScaling	automatedBackup	crossRegionBackup	pitr	kmsRotation	waf	Expected
PRODUCTION	ENFORCE	alb-oidc	private-with-nat	true	true	true	true	true	true	true	true	true	true	true	true	true	true	true	true	✅ PASS
PRODUCTION	ENFORCE	none	public-no-nat	false	false	false	false	false	false	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	alb-oidc	private-with-nat	true	true	true	true	true	true	true	true	true	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	none	public-no-nat	false	false	false	false	false	false	false	false	false	true	true	true	true	true	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	none	private-with-nat	true	true	true	true	false	false	false	false	false	false	false	false	false	false	true	true	⚠️ FAIL
PRODUCTION	ENFORCE	none	public-no-nat	false	false	false	false	false	false	true	true	true	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	alb-oidc	public-no-nat	false	false	false	false	true	true	true	true	true	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	alb-oidc	private-with-nat	true	true	true	true	false	false	false	false	false	false	false	false	false	false	true	true	⚠️ FAIL
PRODUCTION	ENFORCE	none	public-no-nat	false	false	false	false	false	false	false	false	false	true	true	true	true	true	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	alb-oidc	private-with-nat	true	true	true	true	true	true	true	true	true	false	false	false	false	false	true	true	⚠️ FAIL
PRODUCTION	ENFORCE	alb-oidc	private-with-nat	true	true	false	false	true	true	false	false	true	true	false	false	true	false	true	false	⚠️ FAIL
PRODUCTION	ENFORCE	none	public-no-nat	false	false	true	true	false	false	true	true	false	false	true	true	false	true	false	true	⚠️ FAIL
STAGING	ENFORCE	alb-oidc	private-with-nat	true	true	true	true	true	true	true	true	true	false	false	false	false	false	true	true	⚠️ FAIL
STAGING	ENFORCE	none	public-no-nat	false	false	false	false	false	false	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ADVISORY	alb-oidc	private-with-nat	true	true	true	true	true	true	true	true	true	true	true	true	true	true	true	true	✅ PASS
PRODUCTION	ADVISORY	none	public-no-nat	false	false	false	false	false	false	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	alb-oidc	public-no-nat	false	false	false	false	true	true	true	false	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	none	private-with-nat	true	true	true	true	false	false	false	false	false	true	true	true	false	false	true	true	⚠️ FAIL
PRODUCTION	ENFORCE	none	private-with-nat	false	false	false	false	false	false	false	false	false	true	true	true	true	true	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	none	public-no-nat	false	false	false	false	false	false	true	true	true	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	alb-oidc	private-with-nat	true	true	true	true	true	true	true	true	true	false	false	false	false	false	true	true	⚠️ FAIL
PRODUCTION	ENFORCE	none	public-no-nat	false	false	false	false	false	false	false	false	false	true	true	true	true	true	false	false	⚠️ FAIL
STAGING	ADVISORY	alb-oidc	private-with-nat	true	true	true	true	true	true	true	true	true	false	false	false	false	false	true	true	✅ PASS
PRODUCTION	ENFORCE	alb-oidc	public-no-nat	false	false	false	false	false	false	false	false	false	false	false	false	false	false	false	true	⚠️ FAIL

testSoc2EncryptionCombinations

Test Cases: 16 Parameters: 6

profile	ebsEncryption	efsEncryption	s3Encryption	kmsRotation	complianceMode	Expected
PRODUCTION	true	true	true	true	ENFORCE	✅ PASS
PRODUCTION	false	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	ENFORCE	⚠️ FAIL
STAGING	true	true	true	true	ENFORCE	✅ PASS
STAGING	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	false	ADVISORY	⚠️ FAIL

testSoc2NetworkSecurityCombinations

Test Cases: 15 Parameters: 7

profile	hasCert	efsTransit	waf	enhancedWaf	networkMode	complianceMode	Expected
PRODUCTION	true	true	true	true	private-with-nat	ENFORCE	✅ PASS
PRODUCTION	false	true	true	true	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	true	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	true	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	true	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	false	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	false	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	public-no-nat	ENFORCE	✅ PASS
PRODUCTION	false	false	false	true	private-with-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	public-no-nat	ENFORCE	✅ PASS
PRODUCTION	false	false	false	false	public-no-nat	ENFORCE	⚠️ FAIL
STAGING	true	true	true	true	private-with-nat	ENFORCE	✅ PASS
STAGING	false	false	false	false	public-no-nat	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	private-with-nat	ADVISORY	✅ PASS
PRODUCTION	false	false	false	false	public-no-nat	ADVISORY	⚠️ FAIL

testSoc2LoggingAndAuditCombinations

Test Cases: 17 Parameters: 7

profile	cloudTrail	flowLogs	albLogging	awsConfig	retentionDays	complianceMode	Expected
PRODUCTION	true	true	true	true	365	ENFORCE	✅ PASS
PRODUCTION	false	true	true	true	365	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	true	365	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	true	365	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	false	365	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	90	ENFORCE	✅ PASS
PRODUCTION	true	true	true	true	30	ENFORCE	✅ PASS
PRODUCTION	true	true	true	true	7	ENFORCE	✅ PASS
PRODUCTION	false	false	true	true	365	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	false	365	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	true	365	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	365	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	7	ENFORCE	⚠️ FAIL
STAGING	true	true	true	true	365	ENFORCE	✅ PASS
STAGING	false	false	false	false	7	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	365	ADVISORY	✅ PASS
PRODUCTION	false	false	false	false	7	ADVISORY	⚠️ FAIL

testSoc2AvailabilityEdgeCases

Test Cases: 14 Parameters: 9

profile	multiAz	autoScaling	automatedBackup	crossRegionBackup	pitr	rtoHours	rpoHours	complianceMode	Expected
PRODUCTION	true	true	true	true	true	1	1	ENFORCE	✅ PASS
PRODUCTION	true	true	false	false	false	24	24	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	true	true	4	1	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	true	true	false	4	2	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	false	false	8	4	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	true	true	2	1	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	true	0	0	ENFORCE	✅ PASS
PRODUCTION	true	true	true	true	true	24	24	ENFORCE	✅ PASS
PRODUCTION	true	true	true	true	true	168	168	ENFORCE	✅ PASS
PRODUCTION	false	false	false	false	false	24	24	ENFORCE	⚠️ FAIL
STAGING	true	true	true	true	true	1	1	ENFORCE	✅ PASS
STAGING	false	false	false	false	false	24	24	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	true	1	1	ADVISORY	✅ PASS
PRODUCTION	false	false	false	false	false	24	24	ADVISORY	⚠️ FAIL

testSoc2RuntimeTypeVariations

Test Cases: 8 Parameters: 8

profile	runtimeType	multiAz	autoScaling	encryption	monitoring	waf	complianceMode	Expected
PRODUCTION	FARGATE	true	true	true	true	true	ENFORCE	✅ PASS
PRODUCTION	FARGATE	false	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	false	false	true	true	true	ENFORCE	⚠️ FAIL
STAGING	FARGATE	true	true	true	true	true	ENFORCE	✅ PASS
STAGING	FARGATE	false	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	FARGATE	true	true	true	true	true	ADVISORY	✅ PASS
PRODUCTION	FARGATE	false	false	false	false	false	ADVISORY	⚠️ FAIL

testSoc2ComplianceModeTransitions

Test Cases: 18 Parameters: 10

profile	complianceMode	auth	encryption	waf	monitoring	cloudTrail	flowLogs	multiAz	autoScaling	Expected
PRODUCTION	ADVISORY	true	true	true	true	true	true	true	true	✅ PASS
PRODUCTION	ENFORCE	true	true	true	true	true	true	true	true	✅ PASS
PRODUCTION	ADVISORY	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ADVISORY	true	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	true	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ADVISORY	false	true	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	false	true	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ADVISORY	false	false	true	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ENFORCE	false	false	true	false	false	false	false	false	⚠️ FAIL
PRODUCTION	ADVISORY	true	true	true	true	false	false	false	false	✅ PASS
PRODUCTION	ENFORCE	true	true	true	true	false	false	false	false	⚠️ FAIL
PRODUCTION	ADVISORY	false	false	false	false	true	true	true	true	✅ PASS
PRODUCTION	ENFORCE	false	false	false	false	true	true	true	true	⚠️ FAIL
STAGING	ADVISORY	true	true	true	true	true	true	true	true	✅ PASS
STAGING	ENFORCE	true	true	true	true	true	true	true	true	✅ PASS
STAGING	ADVISORY	false	false	false	false	false	false	false	false	⚠️ FAIL
STAGING	ENFORCE	false	false	false	false	false	false	false	false	⚠️ FAIL

testSoc2CombinedSecurityAvailability

Test Cases: 15 Parameters: 10

profile	encryption	transit	monitoring	audit	multiAz	autoScaling	backup	crossRegion	complianceMode	Expected
PRODUCTION	true	true	true	true	true	true	true	true	ENFORCE	✅ PASS
PRODUCTION	true	true	true	true	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	true	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	false	false	true	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	true	true	true	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	true	true	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	false	false	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	false	false	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	false	false	false	true	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	false	true	false	true	false	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	true	false	true	false	true	false	true	ENFORCE	⚠️ FAIL
STAGING	true	true	true	true	false	false	false	false	ENFORCE	⚠️ FAIL
STAGING	false	false	false	false	true	true	true	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	true	true	true	true	true	true	true	ADVISORY	✅ PASS
PRODUCTION	false	false	false	false	false	false	false	false	ADVISORY	⚠️ FAIL

testSoc2BackupAndRecovery

Test Cases: 14 Parameters: 6

profile	backupEnabled	retentionDays	crossRegion	vaultLock	complianceMode	Expected
PRODUCTION	true	90	true	true	ENFORCE	✅ PASS
PRODUCTION	true	90	false	true	ENFORCE	⚠️ FAIL
PRODUCTION	true	90	true	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	30	true	true	ENFORCE	✅ PASS
PRODUCTION	true	14	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	false	0	false	false	ENFORCE	⚠️ FAIL
STAGING	true	14	false	false	ENFORCE	⚠️ FAIL
STAGING	true	30	false	false	ENFORCE	⚠️ FAIL
STAGING	false	0	false	false	ENFORCE	⚠️ FAIL
DEV	false	0	false	false	ENFORCE	⚠️ FAIL
DEV	true	7	false	false	ENFORCE	⚠️ FAIL
PRODUCTION	true	90	true	true	ADVISORY	✅ PASS
PRODUCTION	false	0	false	false	ADVISORY	⚠️ FAIL
STAGING	false	0	false	false	ADVISORY	⚠️ FAIL

testSoc2AvailabilityMonitoring

Test Cases: 10 Parameters: 6

profile	runtime	cloudTrailEnabled	guardDutyEnabled	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	true	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	false	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	false	false	ENFORCE	true	⚠️ FAIL
STAGING	FARGATE	true	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	false	ENFORCE	false	⚠️ FAIL
DEV	FARGATE	false	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	false	ADVISORY	false	⚠️ FAIL

testSoc2ConfidentialityEncryption

Test Cases: 10 Parameters: 8

profile	runtime	ebsEncryption	efsAtRest	efsTransit	s3Encryption	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	true	true	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	true	true	true	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	false	true	true	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	true	false	true	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	true	true	false	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	true	true	true	true	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	false	false	false	false	ENFORCE	true	⚠️ FAIL
STAGING	FARGATE	true	true	true	true	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	false	false	false	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	false	false	false	false	ADVISORY	false	⚠️ FAIL

testSoc2ProcessingIntegrityAuditLogs

Test Cases: 10 Parameters: 5

profile	runtime	retentionDays	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	365	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	730	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	90	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	180	ENFORCE	true	✅ PASS
PRODUCTION	EC2	365	ENFORCE	false	⚠️ FAIL
PRODUCTION	EC2	90	ENFORCE	true	✅ PASS
STAGING	FARGATE	90	ENFORCE	true	✅ PASS
STAGING	EC2	30	ENFORCE	true	✅ PASS
DEV	FARGATE	7	ENFORCE	false	⚠️ FAIL
PRODUCTION	FARGATE	90	ADVISORY	false	⚠️ FAIL

testSoc2MultiCriterionViolations

Test Cases: 9 Parameters: 7

profile	runtime	monitoringEnabled	encryptionEnabled	retentionDays	complianceMode	shouldFail	Expected
PRODUCTION	FARGATE	false	false	90	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	false	true	365	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	false	365	ENFORCE	true	⚠️ FAIL
PRODUCTION	FARGATE	true	true	90	ENFORCE	true	✅ PASS
PRODUCTION	EC2	false	false	90	ENFORCE	true	⚠️ FAIL
PRODUCTION	EC2	true	true	365	ENFORCE	false	⚠️ FAIL
STAGING	FARGATE	false	false	14	ENFORCE	true	⚠️ FAIL
STAGING	FARGATE	true	true	90	ENFORCE	true	✅ PASS
PRODUCTION	FARGATE	false	false	90	ADVISORY	false	⚠️ FAIL

Threat Protection

✅ Compliant: 28 ⚠️ Non-Compliant: 40 Total: 68

testThreatExpandedMalwareProtection §164.308(a)

Test Cases: 17 Parameters: 8

profile	runtime	framework	guardDuty	antiMalware	autoUpdate	scanLogging	containerScanning	Expected
PRODUCTION	FARGATE	PCI-DSS	true	false	false	false	false	⚠️ FAIL
PRODUCTION	FARGATE	PCI-DSS	true	true	true	true	true	✅ PASS
PRODUCTION	FARGATE	HIPAA	true	false	false	false	false	⚠️ FAIL
PRODUCTION	FARGATE	SOC2	true	false	false	false	false	⚠️ FAIL
PRODUCTION	EC2	PCI-DSS	false	false	false	false	false	⚠️ FAIL
PRODUCTION	EC2	PCI-DSS	false	true	false	false	false	⚠️ FAIL
PRODUCTION	EC2	PCI-DSS	false	true	true	false	false	⚠️ FAIL
PRODUCTION	EC2	PCI-DSS	false	true	true	true	false	✅ PASS
PRODUCTION	EC2	PCI-DSS	false	true	true	true	true	✅ PASS
PRODUCTION	FARGATE	PCI-DSS	false	false	false	false	true	⚠️ FAIL
PRODUCTION	FARGATE	PCI-DSS	false	true	true	true	true	✅ PASS
STAGING	FARGATE	PCI-DSS	false	false	false	false	false	⚠️ FAIL
STAGING	EC2	PCI-DSS	false	true	true	true	true	✅ PASS
DEV	FARGATE	PCI-DSS	false	false	false	false	false	⚠️ FAIL
DEV	EC2	PCI-DSS	false	false	false	false	false	⚠️ FAIL
PRODUCTION	FARGATE	NONE	false	false	false	false	false	⚠️ FAIL
PRODUCTION	EC2	NONE	false	false	false	false	false	⚠️ FAIL

testThreatExpandedIntrusionDetection §164.308(a)

Test Cases: 17 Parameters: 6

profile	frameworks	guardDuty	waf	flowLogs	alerts	Expected
PRODUCTION	PCI-DSS	true	true	true	true	✅ PASS
PRODUCTION	PCI-DSS	false	true	true	true	✅ PASS
PRODUCTION	PCI-DSS	true	false	true	true	✅ PASS
PRODUCTION	PCI-DSS	true	true	false	true	✅ PASS
PRODUCTION	PCI-DSS	true	true	true	false	✅ PASS
PRODUCTION	PCI-DSS	false	false	false	false	⚠️ FAIL
PRODUCTION	HIPAA	true	false	false	true	✅ PASS
PRODUCTION	HIPAA	false	false	false	false	⚠️ FAIL
PRODUCTION	HIPAA	true	false	false	false	⚠️ FAIL
PRODUCTION	SOC2	true	true	true	true	✅ PASS
PRODUCTION	SOC2	false	false	false	false	⚠️ FAIL
PRODUCTION	PCI-DSS HIPAA	true	true	true	true	✅ PASS
PRODUCTION	PCI-DSS HIPAA	false	false	false	false	⚠️ FAIL
STAGING	PCI-DSS	false	false	false	false	⚠️ FAIL
STAGING	HIPAA	false	false	false	false	⚠️ FAIL
DEV	PCI-DSS	false	false	false	false	⚠️ FAIL
DEV	HIPAA	false	false	false	false	⚠️ FAIL

testThreatExpandedFileIntegrityMonitoring §164.308(a)

Test Cases: 13 Parameters: 5

profile	runtime	framework	fim	awsConfig	Expected
PRODUCTION	FARGATE	PCI-DSS	false	false	⚠️ FAIL
PRODUCTION	FARGATE	PCI-DSS	true	true	✅ PASS
PRODUCTION	EC2	PCI-DSS	false	false	⚠️ FAIL
PRODUCTION	EC2	PCI-DSS	true	false	✅ PASS
PRODUCTION	EC2	PCI-DSS	false	true	✅ PASS
PRODUCTION	EC2	PCI-DSS	true	true	✅ PASS
PRODUCTION	FARGATE	HIPAA	false	false	⚠️ FAIL
PRODUCTION	EC2	HIPAA	true	true	✅ PASS
PRODUCTION	FARGATE	SOC2	false	false	⚠️ FAIL
STAGING	FARGATE	PCI-DSS	false	false	⚠️ FAIL
STAGING	EC2	PCI-DSS	false	false	⚠️ FAIL
DEV	FARGATE	PCI-DSS	false	false	⚠️ FAIL
DEV	EC2	PCI-DSS	false	false	⚠️ FAIL

testThreatExpandedContainerSecurity §164.308(a)

Test Cases: 11 Parameters: 4

profile	framework	runtimeSecurity	immutable	Expected
PRODUCTION	GDPR	false	false	⚠️ FAIL
PRODUCTION	GDPR	true	false	✅ PASS
PRODUCTION	GDPR	false	true	✅ PASS
PRODUCTION	GDPR	true	true	✅ PASS
PRODUCTION	PCI-DSS	false	true	✅ PASS
PRODUCTION	HIPAA	true	true	✅ PASS
PRODUCTION	SOC2	false	false	⚠️ FAIL
STAGING	GDPR	false	false	⚠️ FAIL
STAGING	PCI-DSS	true	true	✅ PASS
DEV	GDPR	false	false	⚠️ FAIL
DEV	PCI-DSS	false	false	⚠️ FAIL

testThreatExpandedComprehensiveScenarios §164.308(a)

Test Cases: 10 Parameters: 13

profile	runtime	frameworks	guardDuty	antiMalware	autoUpdate	scanLogging	containerScanning	waf	flowLogs	alerts	runtimeSecurity	immutable	Expected
PRODUCTION	FARGATE	PCI-DSS	true	false	false	false	true	true	true	true	true	true	✅ PASS
PRODUCTION	EC2	PCI-DSS	false	true	true	true	true	true	true	true	true	true	✅ PASS
PRODUCTION	EC2	PCI-DSS	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
PRODUCTION	FARGATE	HIPAA	true	false	false	false	false	false	false	false	false	true	⚠️ FAIL
PRODUCTION	FARGATE	GDPR	true	false	false	false	false	false	false	false	true	true	⚠️ FAIL
PRODUCTION	FARGATE	SOC2	true	false	false	false	true	false	false	false	false	true	⚠️ FAIL
PRODUCTION	FARGATE	PCI-DSS HIPAA GDPR	true	false	false	true	true	true	true	true	true	true	✅ PASS
STAGING	FARGATE	PCI-DSS	true	false	false	false	true	true	true	false	false	true	✅ PASS
STAGING	EC2	PCI-DSS	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL
DEV	FARGATE	PCI-DSS HIPAA	false	false	false	false	false	false	false	false	false	false	⚠️ FAIL

📋 Auditor - Compliance Evidence & Control Mapping

For External Auditors & Compliance Assessors

🎯 Audit Purpose

This section provides comprehensive evidence of automated compliance testing for regulatory audits (SOC 2 Type II, HIPAA, PCI-DSS, GDPR). All test evidence is version-controlled, reproducible, and mapped to specific regulatory controls.

🆕 Recent Validation Enhancements

Four critical validation improvements have been implemented and tested:

Enhancement	Impact	Test Coverage	Evidence Location
ConfigurationValidationRules (NEW)	alwaysLoad framework validates basic config errors before compliance checks	44 test cases (subdomain, OIDC-HTTPS)	`ConfigurationValidationRules.java`
PCI-DSS WAF Requirement (STRENGTHENED)	WAF changed from "recommended" to REQUIRED for PRODUCTION	48 WAF test cases across all runtimes/profiles	`PciDssRules.java:317-334`
PCI-DSS Flow Logs (NEW)	Flow logs validation for DEV/STAGING (auto-enabled in PRODUCTION via ComplianceMatrix)	14 flow logs test cases	`PciDssRules.java:527-545`
Test Matrix Expansion	Comprehensive edge case coverage for all validation rules	+467 edge cases (281 → 748 test scenarios)	`compliance-test-matrix.csv` (548 test cases total)

Documentation References:

docs/compliance/PCI_DSS_CONTROLS_GAP_ANALYSIS.md - Updated to v1.2 with corrected WAF evidence
docs/compliance/AUDITOR_EVIDENCE_UPDATES.md - Complete audit evidence with validation fixes
docs/compliance/CSV_PARAMETERIZED_TESTING_EXPANSION.md - Test expansion details
docs/compliance/COMPLIANCE_DOCUMENTATION_UPDATE_SUMMARY.md - Complete change summary

Frameworks Validated

HIPAA, PCI-DSS, GDPR, SOC2 + Security Rules

135

Automated Test Suites

Parameterized truth table tests

1565

Test Scenarios

Compliant + non-compliant paths

523

Positive Controls

Validates compliant configurations pass

1042

Negative Controls

Validates non-compliant configs fail

🔍 Test Evidence Traceability

Version Control: All test code is maintained in Git with full history

Test Execution: Automated CI/CD pipeline runs all tests on every commit

Test Reports: JUnit XML reports + JaCoCo coverage reports generated for each build

Evidence Location: cloudforge-api/src/test/java/com/cloudforgeci/api/core/rules/

Coverage Reports: cloudforge-api/target/site/jacoco/

📐 Compliance Testing Methodology

Methodology Component	Implementation	Audit Evidence
Truth Table Testing	Systematic testing of all configuration branches (compliant + non-compliant paths)	Test case matrices in this report
Parameterized Tests	JUnit 5 @ParameterizedTest with @CsvSource for data-driven testing	Test source code with @CsvSource annotations
CDK Synthesis Validation	Tests trigger CDK synthesis which executes all validation lambdas	Template.fromStack() calls in test methods
Positive Testing	Tests verify compliant configurations pass validation	assertDoesNotThrow() assertions for compliant cases
Negative Testing	Tests verify non-compliant configurations fail validation	assertThrows() assertions for non-compliant cases
Coverage Tracking	JaCoCo measures branch and instruction coverage	JaCoCo HTML reports with line-by-line coverage

🔐 Control Operating Effectiveness Evidence

For SOC 2 Type II audits, the following evidence demonstrates control operating effectiveness:

Design Effectiveness: Truth tables show controls are designed to detect non-compliant configurations
Operating Effectiveness: CI/CD pipeline execution logs show tests run on every commit (continuous operation)
Test Results: 100% test pass rate demonstrates controls operate as designed
Population Completeness: 1565 test scenarios provide comprehensive coverage of all control points
Sample Selection: Automated testing eliminates sampling - 100% of code paths are validated

Framework-Specific Control Mappings

Advanced Monitoring

Test Methods

Total Test Cases

Compliant Scenarios

Non-Compliant Scenarios

Source Implementation: cloudforge-api/src/main/java/com/cloudforgeci/api/core/rules/AdvancedMonitoringRules.java

Test Evidence: cloudforge-api/src/test/java/com/cloudforgeci/api/core/rules/AdvancedMonitoringRulesTest.java

Requirement / Control	Test Methods	Total Cases	✅ Compliant	⚠️ Non-Compliant	Test Details
General	5	67	30	37	testAMExpandedSecurityHub (14 cases) testAMExpandedInspector (14 cases) +3 more

Database Security

Test Methods

Total Test Cases

Compliant Scenarios

Non-Compliant Scenarios

Source Implementation: cloudforge-api/src/main/java/com/cloudforgeci/api/core/rules/DatabaseSecurityRules.java

Test Evidence: cloudforge-api/src/test/java/com/cloudforgeci/api/core/rules/DatabaseSecurityRulesTest.java

Requirement / Control	Test Methods	Total Cases	✅ Compliant	⚠️ Non-Compliant	Test Details
General	7	84	32	52	testDBExpandedRDSSecurity (16 cases) testDBExpandedDynamoDBSecurity (12 cases) +5 more

GDPR

Test Methods

235

Total Test Cases

Compliant Scenarios

157

Non-Compliant Scenarios

Source Implementation: cloudforge-api/src/main/java/com/cloudforgeci/api/core/rules/GdprRules.java

Test Evidence: cloudforge-api/src/test/java/com/cloudforgeci/api/core/rules/GdprRulesTest.java

Requirement / Control	Test Methods	Total Cases	✅ Compliant	⚠️ Non-Compliant	Test Details
Art. 25	20	235	78	157	testGdprSecurityProfileBranches (6 cases) testGdprDataProtectionByDesignEncryption (12 cases) +18 more

HIPAA

Test Methods

266

Total Test Cases

Compliant Scenarios

178

Non-Compliant Scenarios

Source Implementation: cloudforge-api/src/main/java/com/cloudforgeci/api/core/rules/HipaaRules.java

Test Evidence: cloudforge-api/src/test/java/com/cloudforgeci/api/core/rules/HipaaRulesTest.java

Requirement / Control	Test Methods	Total Cases	✅ Compliant	⚠️ Non-Compliant	Test Details
§164.308(a)	21	266	88	178	testHipaaSecurityManagementCombinations (7 cases) testHipaaPhysicalSafeguardsCombinations (9 cases) +19 more

Incident Response

Test Methods

Total Test Cases

Compliant Scenarios

Non-Compliant Scenarios

Source Implementation: cloudforge-api/src/main/java/com/cloudforgeci/api/core/rules/IncidentResponseRules.java

Test Evidence: cloudforge-api/src/test/java/com/cloudforgeci/api/core/rules/IncidentResponseRulesTest.java

Requirement / Control	Test Methods	Total Cases	✅ Compliant	⚠️ Non-Compliant	Test Details
General	9	99	37	62	testIRExpandedIncidentResponsePlan (15 cases) testIRExpandedDisasterRecovery (14 cases) +7 more

ISO 27001

Test Methods

Total Test Cases

Compliant Scenarios

Non-Compliant Scenarios

Source Implementation: cloudforge-api/src/main/java/com/cloudforgeci/api/core/rules/Iso27001Rules.java

Test Evidence: cloudforge-api/src/test/java/com/cloudforgeci/api/core/rules/Iso27001RulesTest.java

Requirement / Control	Test Methods	Total Cases	✅ Compliant	⚠️ Non-Compliant	Test Details
General	1	3	2	1	testIso27001ComplianceByProfile (3 cases)

Key Management

Test Methods

Total Test Cases

Compliant Scenarios

Non-Compliant Scenarios

Source Implementation: cloudforge-api/src/main/java/com/cloudforgeci/api/core/rules/KeyManagementRules.java

Test Evidence: cloudforge-api/src/test/java/com/cloudforgeci/api/core/rules/KeyManagementRulesTest.java

Requirement / Control	Test Methods	Total Cases	✅ Compliant	⚠️ Non-Compliant	Test Details
General	7	67	23	44	testKMExpandedKMSKeyManagement (8 cases) testKMExpandedCertificateManagement (8 cases) +5 more

PCI-DSS

Test Methods

329

Total Test Cases

121

Compliant Scenarios

208

Non-Compliant Scenarios

Source Implementation: cloudforge-api/src/main/java/com/cloudforgeci/api/core/rules/PciDssRules.java

Test Evidence: cloudforge-api/src/test/java/com/cloudforgeci/api/core/rules/PciDssRulesTest.java

Requirement / Control	Test Methods	Total Cases	✅ Compliant	⚠️ Non-Compliant	Test Details
General	34	329	121	208	testPciDssEncryptionCombinations (8 cases) testPciDssAuditLoggingCombinations (7 cases) +32 more

SOC2

Test Methods

347

Total Test Cases

Compliant Scenarios

263

Non-Compliant Scenarios

Source Implementation: cloudforge-api/src/main/java/com/cloudforgeci/api/core/rules/Soc2Rules.java

Test Evidence: cloudforge-api/src/test/java/com/cloudforgeci/api/core/rules/Soc2RulesTest.java

Requirement / Control	Test Methods	Total Cases	✅ Compliant	⚠️ Non-Compliant	Test Details
General	26	347	84	263	testSoc2SecurityProfileBranches (6 cases) testSoc2AccessControls (8 cases) +24 more

Threat Protection

Test Methods

Total Test Cases

Compliant Scenarios

Non-Compliant Scenarios

Source Implementation: cloudforge-api/src/main/java/com/cloudforgeci/api/core/rules/ThreatProtectionRules.java

Test Evidence: cloudforge-api/src/test/java/com/cloudforgeci/api/core/rules/ThreatProtectionRulesTest.java

Requirement / Control	Test Methods	Total Cases	✅ Compliant	⚠️ Non-Compliant	Test Details
§164.308(a)	5	68	28	40	testThreatExpandedMalwareProtection (17 cases) testThreatExpandedIntrusionDetection (17 cases) +3 more

📄 Additional Audit Artifacts Available

CI/CD Pipeline Logs: GitHub Actions workflow execution history
Test Execution Reports: JUnit XML reports with timestamps and results
Code Coverage Reports: JaCoCo HTML reports showing line-by-line validation coverage
Integration Test Reports: Full stack synthesis tests validating end-to-end compliance
Version Control History: Git commit log showing test evolution and maintenance
Compliance Documentation: docs/compliance/ directory with framework-specific guides
Security Policies: docs/security/ directory with policy documentation

✅ Auditor Checklist

This truth table report satisfies the following audit evidence requirements:

☑️ Control Design Documentation: Test methods show how each control is implemented
☑️ Control Operating Evidence: Test results prove controls execute as designed
☑️ Population Completeness: Truth tables document complete test coverage
☑️ Traceability Matrix: Requirements mapped to test methods and source code
☑️ Automated Testing: Eliminates manual testing errors and provides consistency
☑️ Continuous Monitoring: CI/CD ensures controls operate continuously
☑️ Version Control: All test code and results are version-controlled
☑️ Exception Handling: Negative tests prove non-compliant configs are rejected

🔍 Compliance Truth Tables

📊 Executive Summary

Compliance Validation Overview

Advanced Monitoring

Database Security

GDPR

HIPAA

Incident Response

ISO 27001

Key Management

PCI-DSS

SOC2

Threat Protection

Audit Readiness

📖 End-User Guide

Understanding Compliance Validation

What This Means For You

Compliance Modes

Security Profiles

Common Configuration Flags

🔧 Developer - Technical Truth Tables

Advanced Monitoring

testAMExpandedSecurityHub

testAMExpandedInspector

testAMExpandedMacie

testAMExpandedCentralizedMonitoring

testAMExpandedComprehensiveScenarios

Database Security

testDBExpandedRDSSecurity

testDBExpandedDynamoDBSecurity

testDBExpandedDatabaseMonitoring

testDBExpandedComprehensiveScenarios

testRdsBackupRetentionEdgeCases

testPerformanceInsightsEncryptionEdgeCases

testRdsHighAvailabilityEdgeCases

GDPR

testGdprSecurityProfileBranches Art. 25

testGdprDataProtectionByDesignEncryption Art. 25

testGdprNetworkIsolation Art. 25

testGdprProcessingRecordsLogging Art. 25

testGdprSecurityOfProcessingTransit Art. 25

testGdprSecurityMonitoringAndBackup Art. 25

testGdprAwsConfig Art. 25

testGdprBreachDetection Art. 25

testGdprWafProtection Art. 25

testGdprComprehensiveScenarios Art. 25

testGdprExpandedDataProtectionEncryption Art. 25

testGdprExpandedAuditLoggingAndConfig Art. 25

testGdprExpandedSecurityMonitoringAndBreach Art. 25

testGdprExpandedTransmissionSecurity Art. 25

testGdprExpandedBackupAndAvailability Art. 25

testGdprExpandedComprehensiveMultiArticle Art. 25

testGdprDataResidencyEnforcement Art. 25

testGdprEncryptionRequirements Art. 25

testGdprAuditTrailRetention Art. 25

testGdprMultiViolationScenarios Art. 25

HIPAA

testHipaaSecurityManagementCombinations §164.308(a)

testHipaaPhysicalSafeguardsCombinations §164.308(a)

testHipaaAccessControlAuthModeCombinations §164.308(a)

testHipaaAuditControlsCombinations §164.308(a)

testHipaaAuthenticationMfaCombinations §164.308(a)

testHipaaTransmissionSecurityCombinations §164.308(a)

testHipaaRetentionRequirementsCombinations §164.308(a)

testHipaaSecurityProfileBranches §164.308(a)

testHipaaComprehensiveCombinations §164.308(a)

testHipaaExpandedSecurityManagement §164.308(a)

testHipaaExpandedEncryptionAtRest §164.308(a)

testHipaaExpandedAuditLogging §164.308(a)

testHipaaExpandedAuthentication §164.308(a)

testHipaaExpandedTransmissionSecurity §164.308(a)

testHipaaExpandedRetentionPeriods §164.308(a)

testHipaaExpandedPhysicalSafeguards §164.308(a)

testHipaaExpandedComprehensiveMultiRequirement §164.308(a)

testHipaaFlowLogsEnforcement §164.308(a)

testHipaaEncryptionCombinations §164.308(a)

testHipaaAuditLogRetention §164.308(a)

testHipaaMultiViolationScenarios §164.308(a)

Incident Response

testIRExpandedIncidentResponsePlan