aquasecurity / aquasecurity/cloudsploit

[GCP] Scans not functioning due to incorrect field name in credential file documentation

Open
#2,159 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

[GCP credential docs](https://github.com/aquasecurity/cloudsploit?tab=readme-ov-file#gcp)

For using the GCP using credential file, it suggests the following format:

```
{
"project": "",
"client_email": "",
"private_key": ""
}
```

But, as per this [ index.js](https://github.com/aquasecurity/cloudsploit/blob/5f95cdae72afa291a9765392c0a4c37c0734b77a/index.js#L174) line, one is expected to provide "project_id" and not "project"

**Consequences**: This mismatch is causing the "project" field provided to be ignored, hence effectively scans are not happening on the project even though it appears it's being scanned, since no error is raised. This can cause false negatives.

**Suggestion**: Add input validation to surface an explicit error when the required field is missing and rectify the documentation.

If this sounds correct, please assign this issue to me and I can raise the fix.

Contributor guide

Open the contributing guide

Research direction

Start with the GCP credential documentation linked in the issue and the credential handling at index.js around line 174. Verify the expected project_id field, add validation for a missing required field, and update the documented credential example so it matches the implementation; done means the mismatch can no longer silently allow an apparent scan with no project selected.

Written by the indexing model from the issue text.

Assessment

Tech stack
gcp, javascript
Domain
cloud, documentation, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.