gcp-cloudbuild-build-logs

Build output frequently echoes command lines, substituted values, and tool credentials.

gcpcritical service: gcp:cloudbuild emits ContainsSecret

Where it sits

locationcloudbuild.projects.builds.get.logUrl/logsBucket -> Cloud Logging or Cloud Storage log entries
location kindlog_field
data kindscredential password api_key oauth_token private_key connection_string sensitive_data
emits edgeContainsSecret
serviceCloud Build (gcp:cloudbuild)

Collection recipe

access modeindirect_destination
operationcloudbuild.projects.builds.get
response pathlogUrl/logsBucket -> Cloud Logging or Cloud Storage log entries
encodingstring
params{"name": "\u003cresource-name\u003e"}

Required permissions

cloudbuild.builds.get
logging.logEntries.list

References

move · open · esc close