ContainsSecret

CodeBuild project env vars of type SECRETS_MANAGER or PARAMETER_STORE reference secret material injected into every build's environment.

An EventBridge Connection with API_KEY, OAUTH_CLIENT_CREDENTIALS, or BASIC auth contains a stored credential used to authenticate API destination calls.

An SNS topic without a DataProtectionPolicy may carry messages embedding secrets; any subscriber can read them (POTENTIAL - content heuristic, not confirmed).

A Step Functions activity task state embeds the current execution data context as the task payload returned by GetActivityTask; if upstream states processed sensitive data, the payload may contain secrets.

A snapshot of an OS-type disk inherits the OS-disk ContainsSecret classification when the source disk is identified.

A Service Bus queue with active entity-level SAS authorization rules embeds queue-scoped connection-string credentials usable at data-plane without Entra RBAC.

A Service Bus topic with active entity-level SAS authorization rules embeds topic-scoped connection-string credentials usable at data-plane without Entra RBAC.

A Service Bus namespace with active SAS authorization rules embeds connection-string credentials usable at data-plane without Entra RBAC.

A Cloud Scheduler job's HTTP body (httpTarget.body) or Pub/Sub payload (pubsubTarget.data) may embed credentials. Any principal with cloudscheduler.jobs.get / fullView can read the job definition and recover the embedded credential.

Function env vars / mounted Secret Manager bindings carry connection strings / API keys.

A Cloud Tasks task body (httpRequest.body, base64-encoded) contains credential material (API keys, passwords, SA key JSON, connection strings) readable by any principal with cloudtasks.tasks.fullView on the queue.

A workflow execution's argument payload may carry secrets passed by the caller; visible in execution metadata to anyone with executions.get.

Explicit extraction: pipeline definition contains plaintext credential material in activity fields.

DocumentDB cluster stores its master MongoDB user password in a Secrets Manager secret when ManageMasterUserPassword is enabled.

A snapshot of a volume from an instance with an instance profile (IAM role) may contain credentials, SSH keys, or other secrets on the disk. This edge is ONLY emitted when forensic evidence confirms credential material on the disk image, not from structural probability alone. The preconditions are: (1) the volume was attached to an instance with an ExecutesAs role, (2) a snapshot exists of that volume, and (3) forensic scanning or manual inspection has detected credential patterns on the disk.

OpsWorks App secure environment variables are credentials accessible to all deployment code on the stack.

An OS-type managed disk (Windows or Linux) is heuristically classified as containing credential material: SAM/NTDS hive, /etc/shadow, SSH private keys, or application credential files.

A Cloud SQL instance may store application secrets (API keys, SA keys, connection strings, tokens) in its databases based on schema/table metadata heuristics.

A Firestore database contains collections or document field names whose names indicate credential material (API keys, SA keys, OAuth tokens, database passwords).

GetArchiveRule.archiveRule.filter.<criterion>.contains / eq / neq

ListTagsForResource.tags.<value>

GetPrimaryEmail.PrimaryEmail

GetContactInformation.ContactInformation

GetAlternateContact.AlternateContact

DescribeCertificate.Certificate.DomainName / Subject / SubjectAlternativeNames

ListTagsForCertificate.Tags[].Value

GetCertificate.Certificate / CertificateChain

GetCertificateAuthorityCsr.Csr

ListTags.Tags[].Value

GetApp.app.tags.<value>

CloudWatch Logs API Gateway execution/access log event.message

GetTags.tags.<value>

DescribeFlow.sourceFlowConfig.connectorProfileName / sourceConnectorProperties / destinationFlowConfigList[].destinationConnectorProperties / tasks[].taskProperties

ListTagsForResource.tags.<value>

DescribeRoute.route.spec.httpRoute.match.headers[].match.{exact,prefix,regex,suffix}

ListTagsForResource.tags[].value

ListTagsForResource.Tags[].Value

GetQueryExecution.QueryExecution.Query

GetNamedQuery.NamedQuery.QueryString

GetPreparedStatement.PreparedStatement.QueryStatement

ListTagsForResource.Tags[].Value

DescribeAutoScalingGroups.AutoScalingGroups[].Tags[].Value

GetRecoveryPointRestoreMetadata.RestoreMetadata.<value>

GetBackupVaultAccessPolicy.Policy

ListTags.Tags.<value>

ListTagsForResource.tags.<value>

ListTagsForResource.Tags[].Value

Configured S3/CloudWatch Bedrock model invocation log record

ListTagsForResource.tags[].value

DescribeStackEvents.StackEvents[].ResourceStatusReason

DescribeStacks.Stacks[].Tags[].Value

S3 CloudFront standard or real-time log record

ListTagsForResource.Tags.Items[].Value

ListTags.TagList[].Value

StartQuery request.QueryStatement

ListTags.ResourceTagList[].TagsList[].Value

logs:DescribeQueries.queries[].queryString

DescribeAlarms.MetricAlarms[].AlarmDescription / CompositeAlarms[].AlarmDescription

ListMetrics.Metrics[].Dimensions[].Value