gcp-cloudsql-ephemeral-certificate-access-token-input
Ephemeral-certificate requests can include an OAuth access token and must not be captured in request logs or IaC state.
Where it sits
| location | sql.connect.generateEphemeralCert/sql.sslCerts.createEphemeral.request.access_token |
|---|---|
| location kind | secret_value |
| data kinds | oauth_token bearer_token credential |
| emits edge | ContainsCredential |
| service | Cloud SQL (gcp:cloudsql) |
Collection recipe
| access mode | write_only_input |
|---|---|
| operation | sql.connect.generateEphemeralCert/sql.sslCerts.createEphemeral |
| response path | request.access_token |
| encoding | string |
| params | {"name": "\u003cresource-name\u003e"} |
Required permissions
cloudsql.instances.connect