gcp-appengine-application-iap-client-secret-input

App Engine application create and patch requests can carry an input-only IAP OAuth client secret.

gcpcritical service: gcp:appengine emits ContainsCredential

Where it sits

locationappengine.apps.create/appengine.apps.patch.request.iap.oauth2ClientSecret
location kindsecret_value
data kindsoauth_token secret_key credential
emits edgeContainsCredential
serviceApp Engine (gcp:appengine)

Collection recipe

access modewrite_only_input
operationappengine.apps.create/appengine.apps.patch
response pathrequest.iap.oauth2ClientSecret
encodingstring
params{"name": "\u003cresource-name\u003e"}

Required permissions

appengine.applications.create
appengine.applications.update

References

move · open · esc close