aquasecurity / aquasecurity/cloudsploit
[GCP] Scans not functioning due to incorrect field name in credential file documentation
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
[GCP credential docs](https://github.com/aquasecurity/cloudsploit?tab=readme-ov-file#gcp)
For using the GCP using credential file, it suggests the following format:
```
{
"project": "",
"client_email": "",
"private_key": ""
}
```
But, as per this [ index.js](https://github.com/aquasecurity/cloudsploit/blob/5f95cdae72afa291a9765392c0a4c37c0734b77a/index.js#L174) line, one is expected to provide "project_id" and not "project"
**Consequences**: This mismatch is causing the "project" field provided to be ignored, hence effectively scans are not happening on the project even though it appears it's being scanned, since no error is raised. This can cause false negatives.
**Suggestion**: Add input validation to surface an explicit error when the required field is missing and rectify the documentation.
If this sounds correct, please assign this issue to me and I can raise the fix.
Contributor guide
Research direction
Start with the GCP credential documentation linked in the issue and the credential handling at index.js around line 174. Verify the expected project_id field, add validation for a missing required field, and update the documented credential example so it matches the implementation; done means the mismatch can no longer silently allow an apparent scan with no project selected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- gcp, javascript
- Domain
- cloud, documentation, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100