Check Details

• Entity Type: Integration
• Check: Deny Public Access to KMS Keys
• Risk: Publicly accessible KMS keys can be misused by unauthorized users, leading to potential data exposure and compromise.

Remediation via Google Cloud CLI

1. List all Cloud KMS cryptokeys:

   

   gcloud kms keys list \
   --keyring=[KEY_RING_NAME] \
   --location=global \
   --format=json | jq '.[].name'
   

2. Remove IAM policy binding to revoke access from allAuthenticatedUsers:

   

   gcloud kms keys remove-iam-policy-binding [KEY_NAME] \
   --keyring=[KEY_RING_NAME] \
   --location=global \
   --member="allAuthenticatedUsers" \
   --role="[ROLE]"
   

3. Remove IAM policy binding to revoke access from allUsers:

   

   gcloud kms keys remove-iam-policy-binding [KEY_NAME] \
   --keyring=[KEY_RING_NAME] \
   --location=global \
   --member="allUsers" \
   --role="[ROLE]"
   

Default Value

By default, Cloud KMS does not allow access to allUsers or allAuthenticatedUsers.