1. Go to the GCP console and select the project for which you want to remediate the misconfiguration.
2. Navigate to the “APIs & Services” section from the left-hand side menu.
3. Click on the “Credentials” tab from the top menu.
4. On the Credentials page, you will see a list of all the existing credentials for the project.
5. Look for any API keys that have been created for the project. If you find any, select them and click on the “Delete” button to remove them.
6. If there are no API keys, then the misconfiguration is already remediated.
7. To prevent API keys from being created in the future, you can go to the “APIs & Services” section and click on the “Restrict keys” button.
8. On the Restrict keys page, select the “Do not restrict key” option and click on the “Save” button.
9. This will prevent any API keys from being created for the project in the future.

​

1. Open the Cloud Shell in the GCP Console.
2. Run the following command to list all the projects in your GCP account:

gcloud projects list

3. Select the project for which you want to ensure that API keys are not created.
4. Run the following command to check if any API keys are created for the selected project:

gcloud iam service-accounts keys list --iam-account [SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com

5. If any API keys are listed, delete them using the following command:

gcloud iam service-accounts keys delete [KEY-ID] --iam-account [SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com

6. Repeat steps 4 and 5 for all the service accounts in the selected project.
7. Once all the API keys are deleted, ensure that the service accounts are not granted any unnecessary permissions.
8. Verify that no API keys are created for the selected project using the following command:

gcloud iam service-accounts keys list --iam-account [SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com

9. If no API keys are listed, the remediation is complete.

1. First, authenticate to your GCP project using the google-auth library. You can install it using pip:

pip install google-auth

2. Next, use the google-cloud-resource-manager library to retrieve the list of all projects in your GCP account. You can install it using pip:

pip install google-cloud-resource-manager

3. Once you have the list of projects, loop through each project and check if there are any active API keys associated with it. You can use the google-cloud-kms library to list the keys associated with a project:

pip install google-cloud-kms

4. If you find any active API keys associated with a project, you can delete them using the google-cloud-kms library:

from google.cloud import kms_v1

kms_client = kms_v1.KeyManagementServiceClient()

# Replace [PROJECT_ID] and [KEY_RING_ID] with your project and key ring IDs
parent = kms_client.key_ring_path('[PROJECT_ID]', '[KEY_RING_ID]')

# Replace [KEY_ID] with the ID of the key to delete
key_id = kms_client.crypto_key_path('[PROJECT_ID]', '[KEY_RING_ID]', '[KEY_ID]')

# Delete the key
kms_client.destroy_crypto_key(key_id)

5. Finally, you can revoke the API key using the google-auth library:

from google.oauth2.credentials import Credentials

# Replace [API_KEY] with the API key to revoke
creds = Credentials.from_api_key('[API_KEY]')

# Revoke the API key
creds.revoke()