gcp-datastream-saas-oauth-client-secret-input

SaaS connection profiles can carry raw OAuth client secrets rather than Secret Manager references.

gcpcritical service: gcp:datastream emits ContainsCredential

Where it sits

locationdatastream.projects.locations.connectionProfiles.create/datastream.projects.locations.connectionProfiles.patch.request.{salesforceProfile.oauth2ClientCredentials.clientSecret,salesforceMarketingCloudProfile.oauthClientCredentials.clientSecret.rawValue,serviceNowProfile.oauthClientCredentials.clientSecret.rawValue,dataverseProfile.oauthClientCredentials.clientSecret.rawValue,workdayProfile.oauthRefreshTokenCredentials.oauthClientCredentials.clientSecret.rawValue}
location kindsecret_value
data kindsoauth_token secret_key credential
emits edgeContainsCredential
serviceDatastream / Data Fusion (gcp:datastream)

Collection recipe

access modewrite_only_input
operationdatastream.projects.locations.connectionProfiles.create/datastream.projects.locations.connectionProfiles.patch
response pathrequest.{salesforceProfile.oauth2ClientCredentials.clientSecret,salesforceMarketingCloudProfile.oauthClientCredentials.clientSecret.rawValue,serviceNowProfile.oauthClientCredentials.clientSecret.rawValue,dataverseProfile.oauthClientCredentials.clientSecret.rawValue,workdayProfile.oauthRefreshTokenCredentials.oauthClientCredentials.clientSecret.rawValue}
encodingjson
params{"name": "\u003cresource-name\u003e"}

Required permissions

datastream.connectionProfiles.create
datastream.connectionProfiles.update

References

move · open · esc close