gcp-cloudrun-job-literal-environment-values

Cloud Run job environment variables can contain literal credentials instead of secret references.

gcpcritical service: gcp:cloudrun emits ContainsCredential

Where it sits

locationrun.projects.locations.jobs.get.template.template.containers[].env[].value
location kindenvironment_variable
data kindscredential password api_key access_key secret_key oauth_token connection_string
emits edgeContainsCredential
serviceCloud Run (gcp:cloudrun)

Collection recipe

access moderead_api
operationrun.projects.locations.jobs.get
response pathtemplate.template.containers[].env[].value
encodinglist
params{"name": "\u003cresource-name\u003e"}

Required permissions

run.jobs.get

References

move · open · esc close