gcp v1.0.0

The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.

Reference

secret-ref-gcp-service-account-token

Custody

customer_vault

Injection

header (Authorization)

An OAuth 2.0 access token for a dedicated least-privilege GCP service account, held in the client's own secret manager. The stored material must be the complete Authorization header value: the scheme 'Bearer', one separating space, then the token — 'Bearer <token>'. customer_vault is the only generally-supported production custody model here — identity_federation and customer_broker are refused at startup and inline is lab-only. The reviewed token process is the service-account JWT grant Google documents: an external deployment process holds the service account's RSA private key, signs a JWT (RS256; iss = the service account email; scope = the least-privilege read-only scope set https://www.googleapis.com/auth/cloud-platform.read-only plus https://www.googleapis.com/auth/cloud-billing.readonly — the billingAccounts.list operation accepts the cloud-platform, cloud-billing and cloud-billing.readonly scopes, and cloud-platform.read-only alone is not accepted there; aud = https://oauth2.googleapis.com/token; iat and exp, with exp at most one hour after iat per the documented maximum), POSTs it as grant_type urn:ietf:params:oauth:grant-type:jwt-bearer to https://oauth2.googleapis.com/token, receives an access token (expires_in 3600 in the documented response), and writes the complete header value under this reference. Renewal is the external process repeating the grant when the token expires — the executor injects the stored value verbatim and performs no token lifecycle itself. Revocation is disabling or deleting the service account key (or the account) in IAM — but that is a mint-time check, not revocation of issued tokens: Google documents invalid_grant on future JWT exchanges when the signing key is deleted, disabled or expired, while an already-minted access token remains valid until its expiry (expires_in 3600) with no documented per-token revocation. Treat the token lifetime as the exposure window and renew before expiry by repeating the grant. Least privilege: roles/browser (or a custom role carrying exactly resourcemanager.projects.get, resourcemanager.projects.list and resourcemanager.projects.getIamPolicy) at the reviewed parent, plus billing.viewer on the billing accounts in scope — grant nothing broader. Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

• gcp-projects (api, pii): https://cloudresourcemanager.googleapis.com/v3/projects
• gcp-billing-accounts (api, financial): https://cloudbilling.googleapis.com/v1/billingAccounts

Every endpoint here is on shared Google API hosts — cloudresourcemanager.googleapis.com and cloudbilling.googleapis.com — which stay real: they are the documented authorities for these APIs, not tenant placeholders. PROJECT_ID and PARENT_RESOURCE are placeholders the deployment binds before enabling: PARENT_RESOURCE takes the documented form folders/FOLDER_ID or organizations/ORG_ID (projects.list lists direct children of the named parent, and the caller needs resourcemanager.projects.list on that parent), PROJECT_ID a concrete project id or number. The token-minting host oauth2.googleapis.com is likewise a real shared host, but minting is the external process's call, not a capability: the executor injects the minted value and never calls the token endpoint itself, so no capability allowlists it. Tiering rationale: all four capabilities sit at R0, the read floor. projects.getIamPolicy is a POST by HTTP shape (a gRPC-transcoding custom verb with a body carrying only GetPolicyOptions) but a read by effect — it returns the IAM policy bound to the project and changes nothing; it is registered as read with the POST shape stated plainly in the description. The returned policy reveals which principals hold which roles on the project — security configuration that includes human principals' email addresses, so it registers at the pii class — and the exact input a later setIamPolicy (not registered) would rewrite. Billing account list is financial at the read floor — a lower bound: an R0 financial read can still be a serious confidentiality risk. Documented exclusions: this pack does not register projects create/delete/undelete/patch/move, setIamPolicy on any resource, testIamPermissions, organizations or folders listing (projects.list with an organization parent covers the projects directly parented by the organization — projects beneath folders are not returned — and the organizations.search and folders.list methods are not registered), billing account updates (projects.updateBillingInfo, which links or unlinks billing and is a money-relevant write), or the Cloud Billing Budgets and Cloud Asset Inventory APIs. The two list reads describe collection reads only; projects.get is a record read and is registered as one.

Draft review record dated 2026-09-21 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)

• https://docs.cloud.google.com/resource-manager/reference/rest/v3/projects/list (retrieved 2026-09-21)
• https://docs.cloud.google.com/resource-manager/reference/rest/v3/projects/get (retrieved 2026-09-21)
• https://docs.cloud.google.com/resource-manager/reference/rest/v3/projects/getIamPolicy (retrieved 2026-09-21)
• https://cloud.google.com/billing/docs/reference/rest/v1/billingAccounts/list (retrieved 2026-09-21)
• https://developers.google.com/identity/protocols/oauth2/service-account (retrieved 2026-09-21)

A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.