gcp-cloudsql-explicit-contains-secret

id: gcp-cloudsql-explicit-contains-secret
emits: ContainsSecret
description: A Cloud SQL instance may store application secrets (API keys, SA keys, connection strings,
  tokens) in its databases based on schema/table metadata heuristics.
applies_to:
- gcp
match_record:
  api: sqladmin.databases.list
  resource_type: google.sql.Database
  field: name
where:
- 'database or table name suggests credential storage (heuristic: api_keys, credentials, secrets, oauth,
  service_accounts, tokens)'
emit:
  source_type: Data
  target_type: Secret
  source: <Cloud SQL Instance / Database node>
  target: <Secret / Credential node (classified from schema heuristic)>
  permissions: []
  conditions: []
  state_logic: "ACTIVE when application context or schema names strongly suggest credential storage (known\
    \ app, documented schema); CONDITIONAL when only naming heuristics (confidence 0.5\u20130.65); UNKNOWN\
    \ when no schema metadata available."
  false_positive_note: "ContainsSecret is inherently heuristic \u2014 table/column names suggest but do\
    \ not prove credential storage. Never read DB content during collection (that is active exploitation).\
    \ Evidence from cloudsql.databases.list (database names) and application context. credential-chains\
    \ linchpin (read-secret-yields-identity) rolls ContainsSecret + CredentialsFor + CanReadSecret into\
    \ CanImpersonate \u2014 CITE that rule, do not re-derive. Carry confidence 0.5\u20130.65 for heuristic;\
    \ 0.8+ only when app identity confirmed + credential schema documented."
  narrative: '{instance.name} is assessed to contain application secrets (API keys, connection strings,
    or service account credentials) based on schema metadata; a principal with DB read access can extract
    those secrets and pivot.'
  api_source: sqladmin.databases.list
  evidence_field: database name heuristic + application context
  derived_from:
  - google.sql.Instance/Database schema metadata heuristic