gcp-gcf-source-code-get
cloudfunctions.functions.sourceCodeGet returns the deployed source archive, which may embed hardcoded credentials.
match (effective permission)
{
"action": "cloudfunctions.functions.sourceCodeGet",
"resource_type": "google.cloudfunctions.Function"
}
emit
| source | <principal> |
|---|---|
| target | <hardcoded credentials / tokens in the function source> |
| permissions | cloudfunctions.functions.sourceCodeGet |
| conditions | iam_permission |
Narrative
{principal.name} can download the source of {function.name} (cloudfunctions.functions.sourceCodeGet), disclosing any hardcoded credentials.
Raw rule rules/derived/gcp/gcf.yaml
id: gcp-gcf-source-code-get
emits: CanReadCredential
description: cloudfunctions.functions.sourceCodeGet returns the deployed source archive, which may embed
hardcoded credentials.
match_effective_permission:
action: cloudfunctions.functions.sourceCodeGet
resource_type: google.cloudfunctions.Function
emit:
source: <principal>
target: <hardcoded credentials / tokens in the function source>
permissions:
- cloudfunctions.functions.sourceCodeGet
conditions:
- iam_permission
false_positive_note: 'Recon primitive: only yields a credential when the source actually embeds one.
Absent hardcoded secrets this is source disclosure only.'
narrative: '{principal.name} can download the source of {function.name} (cloudfunctions.functions.sourceCodeGet),
disclosing any hardcoded credentials.'