rage.fail

gcp-cloudsql-database-query-results

SQL tables can contain credentials, tokens, PII, and other sensitive application data; Cloud IAM connect permission and database-level authentication and grants are both required.

gcpcritical service: gcp:cloudsql emits CanReadData

Where it sits

location	`SQL SELECT.result rows`
location kind	`data_record`
data kinds	`database_credential` `credential` `customer_data` `pii` `sensitive_data`
emits edge	`CanReadData`
service	Cloud SQL (gcp:cloudsql)

Collection recipe

access mode	`data_plane`
operation	`SQL SELECT`
response path	`result rows`
encoding	`protocol_native`
params	`{"database": "\u003cdatabase\u003e", "instance": "\u003cconnection-name\u003e", "query": "\u003cread-only-query\u003e"}`

Required permissions

cloudsql.instances.connect

References

https://sqladmin.googleapis.com/$discovery/rest?version=v1beta4
https://cloud.google.com/iam/docs/permissions-reference
https://cloud.google.com/sql/docs/mysql/iam-authentication