gcp-appengine-version-deployment-files

Deployed application files can contain hard-coded credentials and configuration secrets.

gcpcritical service: gcp:appengine emits ContainsCredential

Where it sits

locationappengine.apps.services.versions.get.deployment.files.<value>.sourceUrl -> Cloud Storage object bytes
location kindcode_artifact
data kindssource_code_secret credential password api_key private_key
emits edgeContainsCredential
serviceApp Engine (gcp:appengine)

Collection recipe

access modeindirect_destination
operationappengine.apps.services.versions.get
response pathdeployment.files.<value>.sourceUrl -> Cloud Storage object bytes
encodingbinary
params{"name": "\u003cresource-name\u003e"}

Required permissions

appengine.versions.get
storage.objects.get

References

move · open · esc close