gcp-composer-user-workload-secret-data

Composer user-workload secrets expose Kubernetes Secret data to authorized readers.

gcpcritical service: gcp:composer emits CanReadSecret

Where it sits

locationcomposer.projects.locations.environments.userWorkloadsSecrets.get.data.<value>
location kindsecret_value
data kindscredential password api_key private_key sensitive_data
emits edgeCanReadSecret
serviceCloud Composer (Airflow) (gcp:composer)

Collection recipe

access moderead_api
operationcomposer.projects.locations.environments.userWorkloadsSecrets.get
response pathdata.<value>
encodingbase64
params{"name": "\u003cresource-name\u003e"}

Required permissions

composer.userworkloadssecrets.get

References

move · open · esc close