gcp-gcs-contains-secret
match (record)
{
"api": "storage.objects.list",
"field": "name | contentType",
"resource_type": "google.storage.Object"
}
where
object name matches one or more credential-indicator patterns:
*.tfstate (Terraform state — often contains SA keys, DB passwords)
*serviceaccount*.json, *sa-key*.json, *service_account*.json (SA JSON keys)
*.env, *.env.* (environment variable files)
*kubeconfig*, *kube/config* (Kubernetes config with credentials)
*credentials*, *credential* (generic credential files)
*secret* (but not log/report files — apply noise filtering)
*.p12, *.pem, *.key, *.pfx (private key / certificate files)
*password*, *passwd* (password files)
OR contentType == 'application/json' AND bucket name suggests SA key storage (e.g. bucket name contains 'keys', 'credentials', 'service-accounts')
emit
| source type | Storage |
|---|---|
| target type | Secret |
| source | <bucket / ObjectStorage node> |
| target | <Secret node (heuristic classification)> |
Narrative
{bucket.name} contains object '{object.name}' (pattern: {matched_pattern}) - classified as likely holding secret material based on name heuristic. CanReadData on this bucket may yield credentials for another identity (see credential-chains.yaml).
Raw rule rules/explicit/gcp-gcs.yaml
id: gcp-gcs-contains-secret
emits: ContainsSecret
applies_to:
- gcp
match_record:
api: storage.objects.list
resource_type: google.storage.Object
field: name | contentType
where:
- 'object name matches one or more credential-indicator patterns:'
- " *.tfstate (Terraform state \u2014 often contains SA keys, DB passwords)"
- ' *serviceaccount*.json, *sa-key*.json, *service_account*.json (SA JSON keys)'
- ' *.env, *.env.* (environment variable files)'
- ' *kubeconfig*, *kube/config* (Kubernetes config with credentials)'
- ' *credentials*, *credential* (generic credential files)'
- " *secret* (but not log/report files \u2014 apply noise filtering)"
- ' *.p12, *.pem, *.key, *.pfx (private key / certificate files)'
- ' *password*, *passwd* (password files)'
- ' OR contentType == ''application/json'' AND bucket name suggests SA key storage (e.g. bucket name
contains ''keys'', ''credentials'', ''service-accounts'')'
emit:
source_type: Storage
target_type: Secret
source: <bucket / ObjectStorage node>
target: <Secret node (heuristic classification)>
api_source: "storage.objects.list (metadata only \u2014 object content MUST NOT be read)"
evidence_field: object.name pattern match + contentType
permissions: []
narrative: "{bucket.name} contains object '{object.name}' (pattern: {matched_pattern}) \u2014 classified\
\ as likely holding secret material based on name heuristic. CanReadData on this bucket may yield\
\ credentials for another identity (see credential-chains.yaml)."