gcp-tasks-task-body-contains-secret
A Cloud Tasks task body (httpRequest.body, base64-encoded) contains credential material (API keys, passwords, SA key JSON, connection strings) readable by any principal with cloudtasks.tasks.fullView on the queue.
match (record)
{
"field": "httpRequest.body",
"resource_type": "google.cloud.tasks.v2.Task"
}
where
task.httpRequest.body (base64-decoded) contains credential-like material (
API key, password, SA key JSON, OAuth token, connection string)
confirmed via cloudtasks.tasks.fullView-gated tasks.get
emit
| source type | Messaging |
|---|---|
| target type | Secret |
| source | <Cloud Tasks task (Messaging — the payload carrier)> |
| target | <secret / credential material in task body> |
Narrative
Task {task.name} in queue {queue.name} carries credential material in its body. Any principal with cloudtasks.tasks.fullView on the queue can read this credential (credential-chains rolls this into CanImpersonate if it is CredentialsFor a privileged identity).
Raw rule rules/derived/gcp/tasks.yaml
id: gcp-tasks-task-body-contains-secret
emits: ContainsSecret
description: A Cloud Tasks task body (httpRequest.body, base64-encoded) contains credential material (API
keys, passwords, SA key JSON, connection strings) readable by any principal with cloudtasks.tasks.fullView
on the queue.
match_record:
resource_type: google.cloud.tasks.v2.Task
field: httpRequest.body
where:
- task.httpRequest.body (base64-decoded) contains credential-like material (API key, password, SA key
JSON, OAuth token, connection string)
- confirmed via cloudtasks.tasks.fullView-gated tasks.get
emit:
source_type: Messaging
target_type: Secret
source: "<Cloud Tasks task (Messaging \u2014 the payload carrier)>"
target: <secret / credential material in task body>
permissions: []
derived_from:
- task.httpRequest.body field analysis (cloudtasks.tasks.fullView required)
false_positive_note: "Only emit when classification of the task body (base64-decoded) yields a confirmed\
\ credential pattern \u2014 not for every task. Task bodies are not always encrypted at the application\
\ layer even when queue CMEK is enabled. Without cloudtasks.tasks.fullView the body is masked/empty\
\ in API responses \u2014 do not emit based on masked data. Tasks are ephemeral and may be deleted\
\ after dispatch; check retention before treating as persistent secret store. Credential-chains owns\
\ the ContainsSecret \u2192 ExposesCredential \u2192 CredentialsFor roll-up \u2014 cited, not re-derived."
narrative: Task {task.name} in queue {queue.name} carries credential material in its body. Any principal
with cloudtasks.tasks.fullView on the queue can read this credential (credential-chains rolls this
into CanImpersonate if it is CredentialsFor a privileged identity).