gcp-wif-workforce-extra-attributes-secret-input

Workforce extra-attribute retrieval configuration can carry an input-only OAuth client secret.

gcpcritical service: gcp:wif emits ContainsCredential

Where it sits

locationiam.locations.workforcePools.providers.create/iam.locations.workforcePools.providers.patch.request.{extendedAttributesOauth2Client,extraAttributesOauth2Client}.clientSecret.value.plainText
location kindsecret_value
data kindsoauth_token secret_key credential
emits edgeContainsCredential
serviceWorkload Identity Federation (gcp:wif)

Collection recipe

access modewrite_only_input
operationiam.locations.workforcePools.providers.create/iam.locations.workforcePools.providers.patch
response pathrequest.{extendedAttributesOauth2Client,extraAttributesOauth2Client}.clientSecret.value.plainText
encodingjson
params{"name": "\u003cresource-name\u003e"}

Required permissions

iam.googleapis.com/workforcePoolProviders.create
iam.googleapis.com/workforcePoolProviders.update

References

move · open · esc close