gcp-bigquery-explicit-contains-credential

id: gcp-bigquery-explicit-contains-credential
emits: ContainsCredential
description: A BigQuery Connection of type cloudSql or JDBC contains encrypted database credentials stored
  in the connection resource.
match_record:
  resource_type: google.bigquery.Connection
  field: cloudSql.credential | spark.properties (JDBC with password)
where:
- Connection type stores a username/password credential (cloudSql.credential.username/password, JDBC connection
  string with embedded credentials)
emit:
  source_type: Messaging
  target_type: Credential
  source: <BigQuery Connection node>
  target: <DB credential / secret>
  permissions: []
  conditions: []
  state_logic: ACTIVE when the Connection resource is of type cloudSql with credential field, or a Spark/JDBC
    connection with embedded credentials; UNKNOWN when credential presence cannot be confirmed from metadata
    alone.
  false_positive_note: "BigQuery Connection API responses do NOT return raw credential values; they return\
    \ a credential_id (cloudSql) or omit the password. This edge asserts the FACT that a credential is\
    \ stored server-side, which feeds credential-chains ExposesCredential derivations. Do NOT assert CanReadSecret\
    \ from this edge alone \u2014 reading the stored credential requires a code-execution path server-side\
    \ (inside a query using the connection). The stored credential is accessible ONLY via the BigQuery\
    \ execution path (a query that uses the connection), not directly via the API."
  narrative: BigQuery Connection {connection.name} stores database credentials for {target.name} server-side;
    these credentials are used by any query that references this connection.
  derived_from:
  - google.bigquery.Connection.cloudSql.credential or JDBC credential presence
  api_source: bigquery.projects.locations.connections.list + bigquery.projects.locations.connections.get
  evidence_field: cloudSql.credential field, Spark/JDBC connection string with password