​
Event Information

  • The CreateCryptoKey event in GCP for CloudKMS refers to the action of creating a new cryptographic key within the Cloud Key Management Service (CloudKMS) in Google Cloud Platform (GCP).
  • This event signifies the initiation of a new cryptographic key that can be used for encrypting and decrypting data in various GCP services and applications.
  • The CreateCryptoKey event is an important step in establishing secure data encryption practices within GCP, allowing users to generate and manage their own encryption keys for enhanced data protection.

​
Examples

  1. Inadequate key management: If proper key management practices are not followed while using CreateCryptoKey in GCP for CloudKMS, it can lead to security vulnerabilities. For example, if the key is not securely stored or if it is shared with unauthorized users, it can compromise the confidentiality and integrity of the encrypted data.
  2. Weak key generation: If weak cryptographic algorithms or insufficient key lengths are used during the creation of a crypto key in GCP for CloudKMS, it can weaken the security of the encrypted data. For instance, using outdated or insecure algorithms like DES or RSA with small key sizes can make the encryption susceptible to brute-force attacks.
  3. Lack of access controls: If proper access controls are not implemented while creating a crypto key in GCP for CloudKMS, it can result in unauthorized access to the encrypted data. For example, if the key is not properly restricted to only authorized users or if the access policies are misconfigured, it can lead to data breaches or unauthorized decryption of sensitive information.

​
Remediation

​
Using Console

To remediate the issues mentioned in the previous response for GCP CloudKMS using the GCP console, you can follow these step-by-step instructions:
  1. Enable Key Rotation:
    • Go to the GCP Console and navigate to the CloudKMS page.
    • Select the key ring that contains the key you want to rotate.
    • Click on the key you want to rotate.
    • In the key details page, click on the “Edit” button.
    • Under the “Rotation” section, enable key rotation by toggling the switch to “On”.
    • Set the rotation period according to your organization’s security requirements.
    • Click on “Save” to apply the changes.
  2. Enable Key Versioning:
    • Go to the GCP Console and navigate to the CloudKMS page.
    • Select the key ring that contains the key you want to enable versioning for.
    • Click on the key you want to enable versioning for.
    • In the key details page, click on the “Edit” button.
    • Under the “Versioning” section, enable key versioning by toggling the switch to “On”.
    • Click on “Save” to apply the changes.
  3. Enable Key Usage Audit Logging:
    • Go to the GCP Console and navigate to the CloudKMS page.
    • Select the key ring that contains the key you want to enable audit logging for.
    • Click on the key you want to enable audit logging for.
    • In the key details page, click on the “Edit” button.
    • Under the “Audit logging” section, enable key usage audit logging by toggling the switch to “On”.
    • Choose the desired audit log destination, such as Cloud Storage or Cloud Logging.
    • Click on “Save” to apply the changes.
By following these steps, you can remediate the mentioned issues in GCP CloudKMS using the GCP console.

​
Using CLI

To remediate the issues mentioned in the previous response for GCP CloudKMS using GCP CLI, you can follow these steps:
  1. Enable automatic key rotation:
    • Use the following command to enable automatic key rotation for a specific key ring and key: 
      gcloud kms keys update [KEY_NAME] --keyring [KEY_RING_NAME] --rotation-period [ROTATION_PERIOD]
      Replace [KEY_NAME] with the name of the key you want to enable rotation for, [KEY_RING_NAME] with the name of the key ring containing the key, and [ROTATION_PERIOD] with the desired rotation period in seconds.
  2. Implement IAM best practices:
    • Use the following command to grant the necessary IAM roles to users or service accounts: 
      gcloud kms keys add-iam-policy-binding [KEY_NAME] --keyring [KEY_RING_NAME] --member [MEMBER] --role [ROLE]
      Replace [KEY_NAME] with the name of the key, [KEY_RING_NAME] with the name of the key ring, [MEMBER] with the email address or service account of the user or service account you want to grant access to, and [ROLE] with the desired IAM role.
  3. Enable key versioning:
    • Use the following command to enable key versioning for a specific key ring and key: 
      gcloud kms keys versions enable [KEY_VERSION] --key [KEY_NAME] --keyring [KEY_RING_NAME]
      Replace [KEY_VERSION] with the version number of the key you want to enable versioning for, [KEY_NAME] with the name of the key, and [KEY_RING_NAME] with the name of the key ring.
Note: Make sure to replace the placeholders in the commands with the actual values specific to your GCP environment.

​
Using Python

To remediate the issues mentioned in the previous response for GCP CloudKMS using Python, you can follow these steps:
  1. Enable Key Rotation:
    • Use the google-cloud-kms library to retrieve the list of keys in your CloudKMS keyring.
    • Iterate through the keys and check their rotation period using the rotation_period property.
    • If the rotation period is not set or is greater than the desired value, update the key’s rotation period using the update_key method.
    • Here’s an example Python script to enable key rotation:
    from google.cloud import kms

def enable_key_rotation(project_id, location_id, keyring_id):
    client = kms.KeyManagementServiceClient()
    parent = client.key_ring_path(project_id, location_id, keyring_id)

    keys = client.list_crypto_keys(parent)
    for key in keys:
        if not key.rotation_period or key.rotation_period > 90:
            key.rotation_period = 90
            update_mask = {"paths": ["rotation_period"]}
            client.update_crypto_key(key, update_mask)

enable_key_rotation("your-project-id", "your-location-id", "your-keyring-id")
  2. Enable Key Versioning:
    • Use the google-cloud-kms library to retrieve the list of keys in your CloudKMS keyring.
    • Iterate through the keys and check if versioning is enabled using the version_template property.
    • If versioning is not enabled, update the key’s version template to enable it using the update_key method.
    • Here’s an example Python script to enable key versioning:
    from google.cloud import kms

def enable_key_versioning(project_id, location_id, keyring_id):
    client = kms.KeyManagementServiceClient()
    parent = client.key_ring_path(project_id, location_id, keyring_id)

    keys = client.list_crypto_keys(parent)
    for key in keys:
        if not key.version_template:
            key.version_template = {"algorithm": kms.CryptoKeyVersion.CryptoKeyVersionAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION}
            update_mask = {"paths": ["version_template"]}
            client.update_crypto_key(key, update_mask)

enable_key_versioning("your-project-id", "your-location-id", "your-keyring-id")
  3. Enable Key Usage Audit Logging:
    • Use the google-cloud-kms library to retrieve the list of keys in your CloudKMS keyring.
    • Iterate through the keys and check if usage logging is enabled using the logging_config property.
    • If usage logging is not enabled, update the key’s logging configuration to enable it using the update_crypto_key method.
    • Here’s an example Python script to enable key usage audit logging:
    from google.cloud import kms

def enable_key_usage_logging(project_id, location_id, keyring_id):
    client = kms.KeyManagementServiceClient()
    parent = client.key_ring_path(project_id, location_id, keyring_id)

    keys = client.list_crypto_keys(parent)
    for key in keys:
        if not key.logging_config:
            key.logging_config = {"audit_log_configs": [{"log_type": kms.CryptoKeyVersion.CryptoKeyVersionAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION}]}
            update_mask = {"paths": ["logging_config"]}
            client.update_crypto_key(key, update_mask)

enable_key_usage_logging("your-project-id", "your-location-id", "your-keyring-id")
Please replace "your-project-id", "your-location-id", and "your-keyring-id" with your actual GCP project ID, location ID, and keyring ID respectively.