To remediate the KMS Cross Account Access Misconfiguration in GCP using GCP CLI, you can follow these steps:

1. First, you need to identify the KMS keyring and cryptokey that has cross-account access. You can use the following command to list all the KMS keyrings in your GCP project:

   gcloud kms keyrings list
   

   Once you have identified the keyring, you can list all the cryptokeys in that keyring using the following command:

   gcloud kms keys list --keyring=<keyring-name>
   

   Identify the cryptokey that has cross-account access.

2. Once you have identified the cryptokey, you can remove the cross-account access by updating the IAM policy for that cryptokey. You can use the following command to remove all the members from the IAM policy for that cryptokey:

   gcloud kms keys set-iam-policy <key-name> /dev/null
   

   This command sets the IAM policy for the cryptokey to an empty policy, which effectively removes all the members from the policy.

3. Finally, you can verify that the cross-account access has been removed by listing the IAM policy for the cryptokey using the following command:

   gcloud kms keys get-iam-policy <key-name>
   

   This command should return an empty policy, indicating that there are no members with access to the cryptokey.

By following these steps, you can remediate the KMS Cross Account Access Misconfiguration in GCP using GCP CLI.

To remediate the KMS Cross Account Access misconfiguration in GCP using Python, you can follow the below steps:

1. First, you need to identify the KMS key that has cross-account access enabled. You can use the following command to list all the KMS keys in your project:

from google.cloud import kms_v1

client = kms_v1.KeyManagementServiceClient()
parent = client.key_ring_path(project_id, location_id, key_ring_id)

response = client.list_crypto_keys(parent)

for crypto_key in response:
    print(crypto_key.name)

2. Once you have identified the KMS key, you can disable cross-account access by updating the IAM policy of the KMS key. You can use the following code to update the IAM policy:

from google.cloud import kms_v1

client = kms_v1.KeyManagementServiceClient()
resource = client.crypto_key_path(project_id, location_id, key_ring_id, crypto_key_id)

policy = client.get_iam_policy(resource)

for binding in policy.bindings:
    if binding.role == 'roles/cloudkms.cryptoKeyEncrypterDecrypter':
        binding.condition = None
        binding.members = [f'serviceAccount:{project_number}[email protected]']

updated_policy = client.set_iam_policy(resource, policy)

In the above code, we are removing the condition that allows cross-account access and adding the service account of the Compute Engine instance in the same project as a member with the roles/cloudkms.cryptoKeyEncrypterDecrypter role. This will allow the Compute Engine instance to access the KMS key but prevent cross-account access.

3. Finally, you can verify that cross-account access has been disabled for the KMS key by running the following command:

from google.cloud import kms_v1

client = kms_v1.KeyManagementServiceClient()
resource = client.crypto_key_path(project_id, location_id, key_ring_id, crypto_key_id)

policy = client.get_iam_policy(resource)

for binding in policy.bindings:
    if binding.role == 'roles/cloudkms.cryptoKeyEncrypterDecrypter' and binding.condition:
        print('Cross-account access is still enabled')
    else:
        print('Cross-account access has been disabled')

By following these steps, you can remediate the KMS Cross Account Access misconfiguration in GCP using Python.