API key was created within the last 90 days

​

What this check verifies

Google Cloud API keys are evaluated for rotation age using their creation_time. Keys created within the last 90 days are treated as recently rotated; keys older than 90 days are treated as overdue.

​

Risk

Stale, long-lived API keys are bearer tokens without IAM context. If exposed, attackers can invoke allowed APIs, enabling data exfiltration (confidentiality), unauthorized changes (integrity), and quota/billing abuse or disruption (availability). Lack of rotation prolongs misuse.

​

Recommendation

Rotate API keys at least every 90 days. Prefer service accounts or OAuth with short-lived credentials. Enforce API and application/IP restrictions. Store keys in a secrets manager, avoid client-side embedding, and monitor usage. Apply least privilege and defense in depth.

​

Remediation

Dashboard steps

1. In the Google Cloud Console, go to APIs & Services > Credentials
2. Under API keys, click the key older than 90 days
3. Click Rotate key, then click Create to generate the new key
4. Copy the new key string and update your applications to use it
5. In the Previous key section, click Delete the previous key
6. Repeat for any remaining API keys older than 90 days until only keys created within 90 days remain

​

References

• https://cloud.google.com/docs/authentication/api-keys
• https://cloud.google.com/docs/authentication/api-keys-best-practices

​

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = apikeys_key_rotated_in_90_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to GCP checks