gcp-vertexai-rag-corpus-api-key

A legacy RAG vector-database authentication config can persist a literal API key instead of a Secret Manager version reference.

gcpcritical service: gcp:vertexai emits CanReadCredential

Where it sits

locationaiplatform.projects.locations.ragCorpora.get.vectorDbConfig.apiAuth.apiKeyConfig.apiKeyString
location kindsecret_value
data kindsapi_key credential
emits edgeCanReadCredential
serviceVertex AI / Workbench (gcp:vertexai)

Collection recipe

access moderead_api
operationaiplatform.projects.locations.ragCorpora.get
response pathvectorDbConfig.apiAuth.apiKeyConfig.apiKeyString
encodingstring
params{"name": "\u003cresource-name\u003e"}

Required permissions

aiplatform.ragCorpora.get

References

move · open · esc close