gcp-secretmanager-managed-rotation-cloudsql-password-input
The managed-rotation request can carry a Cloud SQL user's plaintext password; the official method currently documents OAuth scopes but no IAM permission action.
Where it sits
| location | secretmanager.projects.secrets.enableManagedRotation/secretmanager.projects.locations.secrets.enableManagedRotation.request.cloudSqlSingleUserCredentials.password |
|---|
| location kind | secret_value |
|---|
| data kinds | password database_credential credential |
|---|
| emits edge | ContainsCredential |
|---|
| service | Secret Manager (gcp:secretmanager) |
|---|
Collection recipe
| access mode | write_only_input |
|---|
| operation | secretmanager.projects.secrets.enableManagedRotation/secretmanager.projects.locations.secrets.enableManagedRotation |
|---|
| response path | request.cloudSqlSingleUserCredentials.password |
|---|
| encoding | string |
|---|
| params | {"name": "\u003cresource-name\u003e"} |
|---|
References