gcp-secretmanager-cmek-ref
explicit
gcp
emits
match (record)
{
"field": "customerManagedEncryption.kmsKeyName",
"resource_type": "google.secretmanager.Secret"
}
where
customerManagedEncryption.kmsKeyName is set (secret is CMEK-encrypted)
emit
Raw rule rules/explicit/gcp-secretmanager.yaml
id: gcp-secretmanager-cmek-ref
emits: null
kind: evidence
applies_to:
- gcp
match_record:
resource_type: google.secretmanager.Secret
field: customerManagedEncryption.kmsKeyName
where:
- customerManagedEncryption.kmsKeyName is set (secret is CMEK-encrypted)
record:
on_node: <secret node>
field: cmek_key
value: <Cloud KMS CryptoKey referenced by kmsKeyName>
api_source: secretmanager.projects.secrets.get
evidence_field: customerManagedEncryption.kmsKeyName
note: 'Evidence for the derived rule gcp-secretmanager-read-cmek-gate: the key_permission condition
is checked against the service agent service-PROJECT_NUMBER@gcp-sa-secretmanager.iam.gserviceaccount.com,
NOT the accessing principal. No graph edge is emitted from the Secret to the key.'