GCP Introduction
GCP Pricing
GCP Threats
GCP Misconfigurations
- Getting Started with GCP Audit
- CloudSql Audit
- Cloud Tasks Monitoring
- Dataflow Monitoring
- Function Monitoring
- Monitoring Compliance
- PubSubLite Monitoring
- Spanner Monitoring
- NoSQL Monitoring
- Compute Audit
- IAM Audit
- BigQuery Monitoring
- CDN Monitoring
- DNS Monitoring
- KMS Monitoring
- Kubernetes Audit
- Load Balancer Monitoring
- Log Monitoring
- Storage Audit
- Pub/Sub Monitoring
- VPC Audit
- IAM Deep Dive
GCP Threats
Ensure API Keys Are Not Created For A Project
More Info:
Security risks involved in using API-Keys appear below: • API keys are simple encrypted strings • API keys do not identify the user or the application making the API request • API keys are typically accessible to clients, making it easy to discover and steal an API key To avoid the security risk in using API keys, it is recommended to use standard authentication flow instead.
Risk Level
High
Address
Security, Reliability
Compliance Standards
CISGCP, CBP, HITRUST, SOC2, NISTCSF
Triage and Remediation
Remediation
To remediate the misconfiguration of API keys not being created for a project in GCP, you can follow the below steps using the GCP console:
-
Go to the GCP console and select the project for which you want to remediate the misconfiguration.
-
Navigate to the “APIs & Services” section from the left-hand side menu.
-
Click on the “Credentials” tab from the top menu.
-
On the Credentials page, you will see a list of all the existing credentials for the project.
-
Look for any API keys that have been created for the project. If you find any, select them and click on the “Delete” button to remove them.
-
If there are no API keys, then the misconfiguration is already remediated.
-
To prevent API keys from being created in the future, you can go to the “APIs & Services” section and click on the “Restrict keys” button.
-
On the Restrict keys page, select the “Do not restrict key” option and click on the “Save” button.
-
This will prevent any API keys from being created for the project in the future.
By following these steps, you can remediate the misconfiguration of API keys not being created for a project in GCP.
To remediate the misconfiguration “Ensure API Keys Are Not Created For A Project” for GCP using GCP CLI, follow these steps:
- Open the Cloud Shell in the GCP Console.
- Run the following command to list all the projects in your GCP account:
gcloud projects list
- Select the project for which you want to ensure that API keys are not created.
- Run the following command to check if any API keys are created for the selected project:
gcloud iam service-accounts keys list --iam-account [SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com
Note: Replace [SA-NAME] with the name of the service account and [PROJECT-ID] with the ID of the selected project.
- If any API keys are listed, delete them using the following command:
gcloud iam service-accounts keys delete [KEY-ID] --iam-account [SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com
Note: Replace [KEY-ID] with the ID of the API key you want to delete, [SA-NAME] with the name of the service account and [PROJECT-ID] with the ID of the selected project.
- Repeat steps 4 and 5 for all the service accounts in the selected project.
- Once all the API keys are deleted, ensure that the service accounts are not granted any unnecessary permissions.
- Verify that no API keys are created for the selected project using the following command:
gcloud iam service-accounts keys list --iam-account [SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com
Note: Replace [SA-NAME] with the name of the service account and [PROJECT-ID] with the ID of the selected project.
- If no API keys are listed, the remediation is complete.
To remediate the issue of ensuring API keys are not created for a project in GCP, you can use the following steps using Python:
- First, authenticate to your GCP project using the
google-authlibrary. You can install it using pip:
pip install google-auth
- Next, use the
google-cloud-resource-managerlibrary to retrieve the list of all projects in your GCP account. You can install it using pip:
pip install google-cloud-resource-manager
- Once you have the list of projects, loop through each project and check if there are any active API keys associated with it. You can use the
google-cloud-kmslibrary to list the keys associated with a project:
pip install google-cloud-kms
- If you find any active API keys associated with a project, you can delete them using the
google-cloud-kmslibrary:
from google.cloud import kms_v1
kms_client = kms_v1.KeyManagementServiceClient()
# Replace [PROJECT_ID] and [KEY_RING_ID] with your project and key ring IDs
parent = kms_client.key_ring_path('[PROJECT_ID]', '[KEY_RING_ID]')
# Replace [KEY_ID] with the ID of the key to delete
key_id = kms_client.crypto_key_path('[PROJECT_ID]', '[KEY_RING_ID]', '[KEY_ID]')
# Delete the key
kms_client.destroy_crypto_key(key_id)
- Finally, you can revoke the API key using the
google-authlibrary:
from google.oauth2.credentials import Credentials
# Replace [API_KEY] with the API key to revoke
creds = Credentials.from_api_key('[API_KEY]')
# Revoke the API key
creds.revoke()
By following these steps, you can ensure that API keys are not created for a project in GCP and remediate any existing misconfigurations.