gcp-secretmanager-credentials-for
The secret's payload authenticates as another identity / service account / data store.
match (record)
{
"field": "payload_classification (name/labels/annotations)",
"resource_type": "google.secretmanager.Secret"
}
where
payload is classified as a credential: SA JSON key ->
ServiceAccount; OAuth/API token -> owning Identity; DB connection string / password -> Data store
emit
| source | <secret> |
|---|---|
| target | <target identity | service account | data store the payload authenticates> |
| state logic | ACTIVE when the payload class is determined from metadata; POTENTIAL when the credential type is unresolved (unknown payload) |
Narrative
Secret {secret.name} holds credentials for {target.name}; reading its payload yields usable credentials for {target.name}.
Raw rule rules/derived/gcp/secretmanager.yaml
id: gcp-secretmanager-credentials-for
emits: CredentialsFor
description: The secret's payload authenticates as another identity / service account / data store.
match_record:
resource_type: google.secretmanager.Secret
field: payload_classification (name/labels/annotations)
where:
- 'payload is classified as a credential: SA JSON key -> ServiceAccount; OAuth/API token -> owning Identity;
DB connection string / password -> Data store'
emit:
source: <secret>
target: <target identity | service account | data store the payload authenticates>
permissions: []
conditions: []
state_logic: ACTIVE when the payload class is determined from metadata; POTENTIAL when the credential
type is unresolved (unknown payload)
confidence: "0.7 (heuristic classification) \u2014 raise to 0.95 when the SA/user/DB is explicitly named\
\ in labels/annotations"
derived_from:
- <secret payload classification evidence>
false_positive_note: 'ASSERTION, not an observed value. Emit only when metadata (name/labels/ annotations)
indicates a credential and identifies the target. NEVER read the payload to confirm. If the payload
type or target is unknown, emit POTENTIAL (or omit) rather than a concrete CredentialsFor to a guessed
identity. Zero base weight: value comes only when paired with CanReadSecret.'
narrative: Secret {secret.name} holds credentials for {target.name}; reading its payload yields usable
credentials for {target.name}.