​
Event Information

  • The CreateKeyRing event in GCP for CloudKMS refers to the action of creating a new key ring within the Cloud Key Management Service (KMS).
  • A key ring is a logical container that holds cryptographic keys and is used to organize and manage keys within Cloud KMS.
  • This event signifies the initiation of a new key ring, which can then be used to store and manage encryption keys for various purposes within the GCP environment.

​
Examples

  1. Insufficient access controls: If proper access controls are not implemented while creating a key ring in CloudKMS, it can lead to unauthorized access to cryptographic keys. This can result in a compromise of sensitive data and a breach of security.

  2. Weak key management practices: If the key ring is not properly managed, including weak key rotation policies, inadequate key length, or lack of key versioning, it can weaken the overall security of the cryptographic keys. This can make it easier for attackers to decrypt encrypted data or impersonate authorized users.

  3. Lack of monitoring and auditing: If there is no proper monitoring and auditing in place for key ring creation in CloudKMS, it can be difficult to detect any unauthorized or malicious activities. This can lead to delayed or missed detection of security incidents, making it harder to respond and mitigate potential risks.

​
Remediation

​
Using Console

To remediate the issues mentioned in the previous response for GCP CloudKMS using the GCP console, you can follow these step-by-step instructions:

  1. Enable Key Rotation:

    • Go to the GCP Console and navigate to the CloudKMS page.
    • Select the key ring that contains the key you want to rotate.
    • Click on the key you want to rotate.
    • In the key details page, click on the “Edit” button.
    • Under the “Rotation” section, enable key rotation by toggling the switch to “On”.
    • Set the rotation period according to your organization’s security requirements.
    • Click on “Save” to apply the changes.

  2. Enable Key Versioning:

    • Go to the GCP Console and navigate to the CloudKMS page.
    • Select the key ring that contains the key you want to enable versioning for.
    • Click on the key you want to enable versioning for.
    • In the key details page, click on the “Edit” button.
    • Under the “Versioning” section, enable key versioning by toggling the switch to “On”.
    • Click on “Save” to apply the changes.

  3. Enable Key Usage Audit Logging:

    • Go to the GCP Console and navigate to the CloudKMS page.
    • Select the key ring that contains the key you want to enable audit logging for.
    • Click on the key you want to enable audit logging for.
    • In the key details page, click on the “Edit” button.
    • Under the “Audit logging” section, enable key usage audit logging by toggling the switch to “On”.
    • Choose the desired audit log destination (e.g., Cloud Storage, BigQuery).
    • Click on “Save” to apply the changes.

By following these steps, you can remediate the mentioned issues in GCP CloudKMS using the GCP console.

​
Using CLI

To remediate the issues mentioned in the previous response for GCP CloudKMS using GCP CLI, you can follow these steps:

  1. Enable automatic key rotation:

    • Use the following command to enable automatic key rotation for a specific key ring and key: 
      gcloud kms keys update [KEY_NAME] --keyring [KEY_RING_NAME] --rotation-period [ROTATION_PERIOD]
      Replace [KEY_NAME] with the name of the key you want to enable rotation for, [KEY_RING_NAME] with the name of the key ring containing the key, and [ROTATION_PERIOD] with the desired rotation period in seconds.

  2. Implement IAM best practices:

    • Use the following command to grant the necessary IAM roles to users or service accounts: 
      gcloud kms keys add-iam-policy-binding [KEY_NAME] --keyring [KEY_RING_NAME] --member [MEMBER] --role [ROLE]
      Replace [KEY_NAME] with the name of the key, [KEY_RING_NAME] with the name of the key ring, [MEMBER] with the email address or service account of the user or service account you want to grant access to, and [ROLE] with the desired IAM role.

  3. Enable key versioning:

    • Use the following command to enable key versioning for a specific key ring and key: 
      gcloud kms keys versions enable [KEY_VERSION] --key [KEY_NAME] --keyring [KEY_RING_NAME]
      Replace [KEY_VERSION] with the version number of the key you want to enable versioning for, [KEY_NAME] with the name of the key, and [KEY_RING_NAME] with the name of the key ring.

Note: Make sure to replace the placeholders in the commands with the actual values specific to your GCP environment.

​
Using Python

To remediate the issues mentioned in the previous response for GCP CloudKMS using Python, you can follow these steps:

  1. Enable Key Rotation:

    • Use the google-cloud-kms library to retrieve the list of keys in your CloudKMS keyring.
    • Iterate through the keys and check their rotation period using the rotation_period property.
    • If the rotation period is not set or is longer than the desired duration, update the key’s rotation period using the update_key method.
    • Here’s an example Python script to enable key rotation:
    from google.cloud import kms

def enable_key_rotation(project_id, location_id, keyring_id):
    client = kms.KeyManagementServiceClient()
    parent = client.key_ring_path(project_id, location_id, keyring_id)

    keys = client.list_crypto_keys(parent)
    for key in keys:
        if not key.rotation_period or key.rotation_period.seconds > desired_rotation_duration:
            key.rotation_period = {"seconds": desired_rotation_duration}
            update_mask = {"paths": ["rotation_period"]}
            client.update_crypto_key(key, update_mask)

enable_key_rotation("your-project-id", "your-location-id", "your-keyring-id")

  2. Enable Key Versioning:

    • Use the google-cloud-kms library to retrieve the list of keys in your CloudKMS keyring.
    • Iterate through the keys and check if versioning is enabled using the version_template property.
    • If versioning is not enabled, update the key’s version template to enable it using the update_key method.
    • Here’s an example Python script to enable key versioning:
    from google.cloud import kms

def enable_key_versioning(project_id, location_id, keyring_id):
    client = kms.KeyManagementServiceClient()
    parent = client.key_ring_path(project_id, location_id, keyring_id)

    keys = client.list_crypto_keys(parent)
    for key in keys:
        if not key.version_template:
            key.version_template = {"algorithm": kms.CryptoKeyVersion.CryptoKeyVersionAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION}
            update_mask = {"paths": ["version_template"]}
            client.update_crypto_key(key, update_mask)

enable_key_versioning("your-project-id", "your-location-id", "your-keyring-id")

  3. Enable Key Usage Audit Logging:

    • Use the google-cloud-kms library to retrieve the list of keys in your CloudKMS keyring.
    • Iterate through the keys and check if usage logging is enabled using the logging_config property.
    • If usage logging is not enabled, update the key’s logging configuration to enable it using the update_crypto_key method.
    • Here’s an example Python script to enable key usage audit logging:
    from google.cloud import kms

def enable_key_usage_logging(project_id, location_id, keyring_id):
    client = kms.KeyManagementServiceClient()
    parent = client.key_ring_path(project_id, location_id, keyring_id)

    keys = client.list_crypto_keys(parent)
    for key in keys:
        if not key.logging_config:
            key.logging_config = {"audit_log_configs": [{"log_type": kms.CryptoKeyVersion.CryptoKeyVersionAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION}]}
            update_mask = {"paths": ["logging_config"]}
            client.update_crypto_key(key, update_mask)

enable_key_usage_logging("your-project-id", "your-location-id", "your-keyring-id")