Check Details

• Entity Type: Integration
• Check: Deny Public Access to KMS Keys
• Risk: Publicly accessible KMS keys can be misused by unauthorized users, leading to potential data exposure and compromise.

Remediation via Google Cloud CLI

1. List all Cloud KMS cryptokeys:

   gcloud kms keys list \
     --keyring=[KEY_RING_NAME] \
     --location=global \
     --format=json | jq '.[].name'
       

2. Remove IAM policy binding to revoke access from allAuthenticatedUsers:

   gcloud kms keys remove-iam-policy-binding [KEY_NAME] \
     --keyring=[KEY_RING_NAME] \
     --location=global \
     --member="allAuthenticatedUsers" \
     --role="[ROLE]"
       

3. Remove IAM policy binding to revoke access from allUsers:

   gcloud kms keys remove-iam-policy-binding [KEY_NAME] \
     --keyring=[KEY_RING_NAME] \
     --location=global \
     --member="allUsers" \
     --role="[ROLE]"
       

Default Value

By default, Cloud KMS does not allow access to allUsers or allAuthenticatedUsers.