gcp-serviceaccounts-signed-blob-output
A signed binary blob can authenticate attacker-controlled content even though the private key is not returned.
Where it sits
| location | iamcredentials.projects.serviceAccounts.signBlob.signedBlob |
|---|
| location kind | output_value |
|---|
| data kinds | credential signing_secret |
|---|
| emits edge | ExposesCredential |
|---|
| service | Service Accounts (gcp:serviceaccounts) |
|---|
Collection recipe
| access mode | read_api |
|---|
| operation | iamcredentials.projects.serviceAccounts.signBlob |
|---|
| response path | signedBlob |
|---|
| encoding | string |
|---|
| params | {"name": "\u003cresource-name\u003e"} |
|---|
Required permissions
iam.serviceAccounts.signBlob
References