gcp-workflows-execution-arg-contains-secret
A workflow execution's argument payload may carry secrets passed by the caller; visible in execution metadata to anyone with executions.get.
match (record)
{
"field": "argument",
"resource_type": "google.workflows.type.Execution"
}
where
argument JSON contains credential-like material (
API keys, passwords, SA key JSON, connection strings)
emit
| source type | Messaging |
|---|---|
| target type | Secret |
| source | <execution (Messaging — the event payload carrier)> |
| target | <secret / credential material in argument> |
Narrative
A running or completed execution of {workflow.name} carries credential material in its argument payload, visible to any principal with workflows.executions.get.
Raw rule rules/derived/gcp/workflows.yaml
id: gcp-workflows-execution-arg-contains-secret
emits: ContainsSecret
description: A workflow execution's argument payload may carry secrets passed by the caller; visible in
execution metadata to anyone with executions.get.
match_record:
resource_type: google.workflows.type.Execution
field: argument
where:
- argument JSON contains credential-like material (API keys, passwords, SA key JSON, connection strings)
emit:
source_type: Messaging
target_type: Secret
source: "<execution (Messaging \u2014 the event payload carrier)>"
target: <secret / credential material in argument>
permissions: []
derived_from:
- execution.argument field analysis
note: Drives ExposesCredential when an attacker with executions.get can read execution history. Credential-chains
reads this as ContainsSecret -> ExposesCredential -> CredentialsFor.
false_positive_note: "Only emit when classification of the argument field yields a confirmed credential\
\ pattern \u2014 not for every execution. Executions are ephemeral; arguments may be cleared in execution\
\ history depending on retention settings."
narrative: A running or completed execution of {workflow.name} carries credential material in its argument
payload, visible to any principal with workflows.executions.get.