gcp-workflows-source-code-get
workflows.workflows.get returns the full workflow definition source, which may embed hardcoded credentials, API keys, or connection strings in step parameters.
match (effective permission)
{
"action": "workflows.workflows.get",
"resource_type": "google.workflows.type.Workflow"
}
where
definition analysis confirms credential-like patterns (
API keys, SA key JSON, passwords in step arguments)
emit
| source type | Messaging |
|---|---|
| target type | Credential |
| source | <workflow> |
| target | <hardcoded credential / token in the definition> |
| permissions | workflows.workflows.get |
| conditions | iam_permission |
Narrative
The workflow definition of {workflow.name} contains hardcoded credential material ({credential_type}), visible to any principal with workflows.workflows.get permission.
Raw rule rules/derived/gcp/workflows.yaml
id: gcp-workflows-source-code-get
emits: ContainsCredential
description: workflows.workflows.get returns the full workflow definition source, which may embed hardcoded
credentials, API keys, or connection strings in step parameters.
match_effective_permission:
action: workflows.workflows.get
resource_type: google.workflows.type.Workflow
where:
- definition analysis confirms credential-like patterns (API keys, SA key JSON, passwords in step arguments)
emit:
source_type: Messaging
target_type: Credential
source: <workflow>
target: <hardcoded credential / token in the definition>
permissions:
- workflows.workflows.get
derived_from:
- 'effective permission: workflows.workflows.get on the workflow resource; definition static analysis'
conditions:
- iam_permission
false_positive_note: 'Only emit when static analysis of the definition content confirms credential-like
patterns (hardcoded API key, SA key JSON, password in a step argument). This is a CanReadCredential
derivation: credential-chains rule reads ContainsCredential on the Workflow node and emits CanReadCredential(principal
with .get -> credential).'
narrative: The workflow definition of {workflow.name} contains hardcoded credential material ({credential_type}),
visible to any principal with workflows.workflows.get permission.