gcp-cloudsql-demote-primary-replication-secrets-input

A demote-primary request can carry a replication password and PEM client private key that Cloud SQL passes into MySQL replication setup.

gcpcritical service: gcp:cloudsql emits ContainsCredential

Where it sits

locationsql.instances.demoteMaster.request.demoteMasterContext.replicaConfiguration.mysqlReplicaConfiguration.{password,clientKey}
location kindsecret_value
data kindspassword private_key database_credential credential
emits edgeContainsCredential
serviceCloud SQL (gcp:cloudsql)

Collection recipe

access modewrite_only_input
operationsql.instances.demoteMaster
response pathrequest.demoteMasterContext.replicaConfiguration.mysqlReplicaConfiguration.{password,clientKey}
encodingjson
params{"name": "\u003cresource-name\u003e"}

Required permissions

cloudsql.instances.demoteMaster

References

move · open · esc close