rage.fail

gcp-secretmanager-credentials-for-explicit

explicit gcp emits CredentialsFor

match (record)

{ "field": "name | labels | annotations", "resource_type": "google.secretmanager.Secret" }

where

metadata classifies the payload as a credential (SA JSON key -> ServiceAccount; OAuth/API token -> Identity; DB connection string / password -> Data)

emit

source	`<secret node>`
target	`<classified target identity / service account / data store>`

Narrative

{secret.name} holds credentials for {target.name} (classified from secret metadata).

Raw rule rules/explicit/gcp-secretmanager.yaml

id: gcp-secretmanager-credentials-for-explicit
emits: CredentialsFor
applies_to:
- gcp
match_record:
  resource_type: google.secretmanager.Secret
  field: name | labels | annotations
where:
- metadata classifies the payload as a credential (SA JSON key -> ServiceAccount; OAuth/API token -> Identity;
  DB connection string / password -> Data)
emit:
  source: <secret node>
  target: <classified target identity / service account / data store>
  api_source: secretmanager.projects.secrets.get
  evidence_field: name | labels | annotations
  narrative: '{secret.name} holds credentials for {target.name} (classified from secret metadata).'