azure-acr-task-secret-inputs

Task-run secret values are supplied as plaintext API inputs even when later redacted.

azurecritical service: azure:acr emits ContainsSecret

Where it sits

locationMicrosoft.ContainerRegistry/registries/tasks/runs request.values[].{value,isSecret}
location kindsecret_value
data kindscredential password api_key access_key secret_key oauth_token connection_string
emits edgeContainsSecret
serviceContainer Registry (azure:acr)

Collection recipe

access modewrite_only_input
operationRuns - Update
response pathrequest.properties.values[?isSecret].value
encodingjson
params{"resource_id": "\u003cazure-resource-id\u003e"}

Required permissions

Microsoft.ContainerRegistry/registries/runs/write

References

move · open · esc close