Api keys not used remediation

Using Console

To remediate the misconfiguration of API keys not being created for a project in GCP, you can follow the below steps using the GCP console:

Go to the GCP console and select the project for which you want to remediate the misconfiguration.
Navigate to the “APIs & Services” section from the left-hand side menu.
Click on the “Credentials” tab from the top menu.
On the Credentials page, you will see a list of all the existing credentials for the project.
Look for any API keys that have been created for the project. If you find any, select them and click on the “Delete” button to remove them.
If there are no API keys, then the misconfiguration is already remediated.
To prevent API keys from being created in the future, you can go to the “APIs & Services” section and click on the “Restrict keys” button.
On the Restrict keys page, select the “Do not restrict key” option and click on the “Save” button.
This will prevent any API keys from being created for the project in the future.

By following these steps, you can remediate the misconfiguration of API keys not being created for a project in GCP.

Using CLI

To remediate the misconfiguration “Ensure API Keys Are Not Created For A Project” for GCP using GCP CLI, follow these steps:

Open the Cloud Shell in the GCP Console.
Run the following command to list all the projects in your GCP account:

gcloud projects list

Select the project for which you want to ensure that API keys are not created.
Run the following command to check if any API keys are created for the selected project:

gcloud iam service-accounts keys list --iam-account [SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com

Note: Replace [SA-NAME] with the name of the service account and [PROJECT-ID] with the ID of the selected project.

If any API keys are listed, delete them using the following command:

gcloud iam service-accounts keys delete [KEY-ID] --iam-account [SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com

Note: Replace [KEY-ID] with the ID of the API key you want to delete, [SA-NAME] with the name of the service account and [PROJECT-ID] with the ID of the selected project.

Repeat steps 4 and 5 for all the service accounts in the selected project.
Once all the API keys are deleted, ensure that the service accounts are not granted any unnecessary permissions.
Verify that no API keys are created for the selected project using the following command:

gcloud iam service-accounts keys list --iam-account [SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com

Note: Replace [SA-NAME] with the name of the service account and [PROJECT-ID] with the ID of the selected project.

If no API keys are listed, the remediation is complete.

Using Python

To remediate the issue of ensuring API keys are not created for a project in GCP, you can use the following steps using Python:

First, authenticate to your GCP project using the google-auth library. You can install it using pip:

pip install google-auth

Next, use the google-cloud-resource-manager library to retrieve the list of all projects in your GCP account. You can install it using pip:

pip install google-cloud-resource-manager

Once you have the list of projects, loop through each project and check if there are any active API keys associated with it. You can use the google-cloud-kms library to list the keys associated with a project:

pip install google-cloud-kms

If you find any active API keys associated with a project, you can delete them using the google-cloud-kms library:

from google.cloud import kms_v1

kms_client = kms_v1.KeyManagementServiceClient()

# Replace [PROJECT_ID] and [KEY_RING_ID] with your project and key ring IDs
parent = kms_client.key_ring_path('[PROJECT_ID]', '[KEY_RING_ID]')

# Replace [KEY_ID] with the ID of the key to delete
key_id = kms_client.crypto_key_path('[PROJECT_ID]', '[KEY_RING_ID]', '[KEY_ID]')

# Delete the key
kms_client.destroy_crypto_key(key_id)

Finally, you can revoke the API key using the google-auth library:

from google.oauth2.credentials import Credentials

# Replace [API_KEY] with the API key to revoke
creds = Credentials.from_api_key('[API_KEY]')

# Revoke the API key
creds.revoke()

By following these steps, you can ensure that API keys are not created for a project in GCP and remediate any existing misconfigurations.

Using Terraform

resource "google_org_policy_policy" "no_api_keys_for_project" {
  # Replace PROJECT_ID with the numeric or string project ID where
  # API key creation must be disabled.
  name   = "projects/PROJECT_ID/policies/apikeys.allowedKeyCreators"
  parent = "projects/PROJECT_ID"

  spec {
    rules {
      # Deny all principals from creating API keys in this project.
      deny_all = true
    }
  }
}

This uses the apikeys.allowedKeyCreators organization policy at the project level to block creation of any new API keys in the project; existing API keys are not automatically deleted by this policy.This change does not force replacement of the project itself, only creates/updates the org policy.Verification: terraform plan should show a single google_org_policy_policy.no_api_keys_for_project resource being created (or updated) with deny_all = true for the apikeys.allowedKeyCreators constraint.

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Api keys not used remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation