API key is restricted to specific Google APIs

Check ID: apikeys_api_restrictions_configured
Provider: GCP
Service: apikeys
Severity: HIGH
Categories: secrets, identity-access
Resource type: apikeys.googleapis.com/Key

What this check verifies

Google Cloud API keys have API restrictions limiting calls to specific services. The finding checks that keys are restricted to named Google APIs and do not include the broad cloudapis.googleapis.com, indicating keys are scoped only to intended use.

Risk

Unrestricted keys-or ones allowing cloudapis.googleapis.com-expand attack surface. A leaked key can call many APIs without identity, enabling data exposure, unintended changes on permissive endpoints, and quota/billing exhaustion, impacting confidentiality, integrity, and availability.

Recommendation

Apply least privilege: restrict each API key to only the specific APIs it must access and never include cloudapis.googleapis.com. Add application restrictions (referrers, IPs, app IDs), rotate keys, and monitor usage. Prefer service accounts or short-lived tokens for production as part of defense in depth.

Remediation

CLI
Terraform
Dashboard steps

gcloud services api-keys update <KEY_ID> --api-target=service=<SERVICE_NAME>

resource "google_apikeys_key" "key" {
  display_name = "<example_resource_name>"

  restrictions {
    api_targets {
      service = "<SERVICE_NAME>" # Critical: restricts the key to a specific API, removing any "All Google APIs" (cloudapis.googleapis.com)
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = apikeys_api_restrictions_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

API key is restricted when the Gemini API is enabled Project has no active API keys

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires