gcp-cloudsql-ephemeral-certificate-access-token-input

Ephemeral-certificate requests can include an OAuth access token and must not be captured in request logs or IaC state.

gcpcritical service: gcp:cloudsql emits ContainsCredential

Where it sits

locationsql.connect.generateEphemeralCert/sql.sslCerts.createEphemeral.request.access_token
location kindsecret_value
data kindsoauth_token bearer_token credential
emits edgeContainsCredential
serviceCloud SQL (gcp:cloudsql)

Collection recipe

access modewrite_only_input
operationsql.connect.generateEphemeralCert/sql.sslCerts.createEphemeral
response pathrequest.access_token
encodingstring
params{"name": "\u003cresource-name\u003e"}

Required permissions

cloudsql.instances.connect

References

move · open · esc close