ContainsCredential
Resource stores a usable credential. Includes hardcoded credentials in workflow definitions, SAS keys in message connectors, and API keys in event subscriptions.
Storage, Data, Compute, Messaging
── ContainsCredential ──▸
Credential, AccessKey, Token
Source types
StorageDataComputeMessagingTarget types
States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | explicit |
|---|
Rules that emit ContainsCredential 11
workflows.workflows.get returns the full workflow definition source, which may embed hardcoded credentials, API keys, or connection strings in step parameters.
gcpderived
awsexplicit
azureexplicit
azureexplicit
azureexplicit
azureexplicit
ANF account with AD join configured contains the machine account password as an AccessKey.
azureexplicit
azureexplicit
azureexplicit
azureexplicit
A BigQuery Connection of type cloudSql or JDBC contains encrypted database credentials stored in the connection resource.
gcpexplicit
Exposure sites that emit ContainsCredential 214
ImportCertificate.PrivateKey
awscritical
GetApp.app.environmentVariables.<value>
awscritical
GetBranch.branch.environmentVariables.<value>
awscritical
GetApp.app.buildSpec
awscritical
GetJob.job.steps[].logUrl -> build log
awscritical
GetStage.variables.<value>
awscritical
GetIntegration.requestTemplates.<content-type> / GetIntegration.requestParameters.<key> / uri
awscritical
apigatewayv2:GetStage.StageVariables.<value>
awscritical
CreateConnectorProfile.connectorProfileConfig.connectorProfileCredentials
awscritical
DescribeService.Service.SourceConfiguration.CodeRepository.CodeConfiguration.CodeConfigurationValues.RuntimeEnvironmentVariables / ImageRepository.ImageConfiguration.RuntimeEnvironmentVariables
awscritical
DescribeService.Service.SourceConfiguration.CodeRepository.CodeConfiguration.CodeConfigurationValues.BuildCommand / StartCommand / ImageRepository.ImageConfiguration.StartCommand
awshigh
ExportNotebook.Payload
awscritical
DescribeLaunchConfigurations.LaunchConfigurations[].UserData
awscritical
DescribeLifecycleHooks.LifecycleHooks[].NotificationMetadata
awshigh
DescribeJobDefinitions.jobDefinitions[].containerProperties.environment[].value / ecsProperties.taskProperties[].containers[].environment[].value / eksProperties.podProperties.containers[].env[].value
awscritical
DescribeJobDefinitions.jobDefinitions[].parameters / containerProperties.command / eksProperties.podProperties.containers[].command|args
awshigh
DescribeJobs.jobs[].parameters / container.environment[].value / ecsProperties.taskProperties[].containers[].environment[].value / eksProperties.podProperties.containers[].env[].value
awscritical
DescribeConfigurationSettings.ConfigurationSettings[].OptionSettings[Namespace=aws:elasticbeanstalk:application:environment].Value
awscritical
DescribeConfigurationSettings.ConfigurationSettings[].OptionSettings[].Value (TemplateName)
awscritical
DescribeApplicationVersions.ApplicationVersions[].SourceBundle -> S3 object body
awscritical
bedrock-agent:GetPrompt.variants[].templateConfiguration
awscritical
bedrock-agent:GetAgent.agent.instruction / promptOverrideConfiguration
awscritical
bedrock-agent:GetAgentActionGroup.agentActionGroup.apiSchema.payload / functionSchema
awshigh
DescribeStacks.Stacks[].Parameters[].ParameterValue
awscritical
GetTemplate.TemplateBody (Parameters.Default, Metadata, Mappings, Resources properties, Outputs)
awscritical
GetDistributionConfig.DistributionConfig.Origins.Items[].CustomHeaders.Items[].HeaderValue
awscritical
GetFunction.FunctionCode
awscritical
CloudHSM CLI user create/change-password password input
awscritical
GetDashboard.DashboardBody
awshigh
BatchGetProjects.projects[].environment.environmentVariables[type=PLAINTEXT].value
awscritical
BatchGetProjects.projects[].source.buildspec / projects[].secondarySources[].buildspec
awscritical
BatchGetBuilds.builds[].environment.environmentVariables[].value
awscritical
CloudWatch Logs/S3 CodeBuild log content
awscritical
GetDeployment.deploymentInfo.revision.appSpecContent.content
awscritical
GetDeployment.DeploymentInfo.Revision.S3Location / GitHubLocation -> revision files
awscritical
Target host or Lambda deployment CloudWatch Logs event.message
awscritical
GetPipeline.pipeline.stages[].actions[].configuration.<value>
awscritical
GetPipeline.pipeline.variables[].defaultValue
awscritical
DescribeConfigRules.ConfigRules[].InputParameters
awshigh
DescribeRemediationConfigurations.RemediationConfigurations[].Parameters.<name>.StaticValue.Values[]
awscritical