rage.fail

gcp-secretmanager-located-in

explicit gcp emits LocatedIn

match (record)

{ "field": "replication.userManaged.replicas | name (locations/*)", "resource_type": "google.secretmanager.Secret" }

where

secret is regional (locations/<region>/secrets/*) or user-managed replication pins specific regions

emit

source type	`*`
source	`<secret node>`
target	`<region / location boundary>`

Narrative

{secret.name} is located in {region} (data residency).

Raw rule rules/explicit/gcp-secretmanager.yaml

id: gcp-secretmanager-located-in
emits: LocatedIn
applies_to:
- gcp
match_record:
  resource_type: google.secretmanager.Secret
  field: replication.userManaged.replicas | name (locations/*)
where:
- secret is regional (locations/<region>/secrets/*) or user-managed replication pins specific regions
emit:
  source_type: '*'
  source: <secret node>
  target: <region / location boundary>
  api_source: secretmanager.projects.secrets.get
  evidence_field: replication | name
  narrative: '{secret.name} is located in {region} (data residency).'