gcp-gcf-env-secret-contains
Function env vars / mounted Secret Manager bindings carry connection strings / API keys.
match (record)
{
"field": "serviceConfig.environmentVariables | serviceConfig.secretEnvironmentVariables | serviceConfig.secretVolumes",
"resource_type": "google.cloudfunctions.Function"
}
where
environmentVariables contain credential-like material OR secretEnvironmentVariables/secretVolumes bind
Secret Manager secrets
emit
| source | <function> |
|---|---|
| target | <secret / credential material in env vars or bound Secret Manager secret> |
Narrative
{function.name} contains secret material in its environment variables / bound Secret Manager secrets.
Raw rule rules/derived/gcp/gcf.yaml
id: gcp-gcf-env-secret-contains
emits: ContainsSecret
description: Function env vars / mounted Secret Manager bindings carry connection strings / API keys.
match_record:
resource_type: google.cloudfunctions.Function
field: serviceConfig.environmentVariables | serviceConfig.secretEnvironmentVariables | serviceConfig.secretVolumes
where:
- environmentVariables contain credential-like material OR secretEnvironmentVariables/secretVolumes bind
Secret Manager secrets
emit:
source: <function>
target: <secret / credential material in env vars or bound Secret Manager secret>
permissions: []
note: 'Drives ExposesCredential once code/config control exists: an attacker with CanModifyCode/CanModifyConfiguration
or execution reads the env/secret material.'
narrative: '{function.name} contains secret material in its environment variables / bound Secret Manager
secrets.'