gcp-wif-workforce-provider-oidc-secret-input

Workforce pool OIDC provider create and update requests can carry an input-only plaintext client secret.

gcpcritical service: gcp:wif emits ContainsCredential

Where it sits

locationiam.locations.workforcePools.providers.create/iam.locations.workforcePools.providers.patch.request.oidc.clientSecret.value.plainText
location kindsecret_value
data kindsoauth_token secret_key credential
emits edgeContainsCredential
serviceWorkload Identity Federation (gcp:wif)

Collection recipe

access modewrite_only_input
operationiam.locations.workforcePools.providers.create/iam.locations.workforcePools.providers.patch
response pathrequest.oidc.clientSecret.value.plainText
encodingstring
params{"name": "\u003cresource-name\u003e"}

Required permissions

iam.googleapis.com/workforcePoolProviders.create
iam.googleapis.com/workforcePoolProviders.update

References

move · open · esc close