API key is restricted when the Gemini API is enabled

Check ID: apikeys_api_restricted_with_gemini_api
Provider: GCP
Service: apikeys
Severity: HIGH
Categories: secrets, gen-ai, identity-access
Resource type: apikeys.googleapis.com/Key

What this check verifies

The Gemini API (a.k.a. Generative Language API, generativelanguage.googleapis.com) uses API keys to authenticate requests for uploaded files and cached content. For projects with the Gemini API enabled, each API key should have API restrictions configured to limit access to specific services.

Risk

Leaked, unrestricted API keys allow access to sensitive uploaded files and cached content, impacting their confidentiality. The risk of leaks is particularly high because traditionally, Google API keys were not considered sensitive and might be embedded in website source code, mobile apps, etc.

Recommendation

Apply API restrictions so that each key only has access to specific APIs. Do not allow access to the “Generative Language API” in particular. If access to the “Generative Language API” is required, be aware of the consequences. Only use the key for this specific purpose and ensure adequate secrets storage. Alternatively, completely disable the Gemini API (a.k.a. Generative Language API, generativelanguage.googleapis.com) in the project’s enabled services.

Remediation

CLI
Terraform
Dashboard steps

gcloud services api-keys update <KEY_ID> --api-target=service=<SERVICE_NAME>

resource "google_apikeys_key" "key" {
  display_name = "<example_resource_name>"

  restrictions {
    api_targets {
      service = "<SERVICE_NAME>" # Critical: restricts the key to a specific API, removing any "All Google APIs" (cloudapis.googleapis.com)
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = apikeys_api_restricted_with_gemini_api. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

GCP checks API key is restricted to specific Google APIs

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires