gcp-loadbalancing-iap-client-secret-input
An IAP OAuth client secret is a write-only backend-service input and can leak through IaC state or request logging.
Where it sits
| location | compute.backendServices.insert/compute.backendServices.patch/compute.backendServices.update.request.iap.oauth2ClientSecret |
|---|---|
| location kind | secret_value |
| data kinds | oauth_token secret_key credential |
| emits edge | ContainsCredential |
| service | Cloud Load Balancing (gcp:loadbalancing) |
Collection recipe
| access mode | write_only_input |
|---|---|
| operation | compute.backendServices.insert/compute.backendServices.patch/compute.backendServices.update |
| response path | request.iap.oauth2ClientSecret |
| encoding | string |
| params | {"name": "\u003cresource-name\u003e"} |
Required permissions
compute.backendServices.create compute.backendServices.update