Cloud KMS roles enforce separation of duties

Check ID: iam_role_kms_enforce_separation_of_duties
Provider: GCP
Service: iam
Severity: MEDIUM
Categories: identity-access, encryption
Resource type: cloudresourcemanager.googleapis.com/Project

What this check verifies

Project IAM assignments are analyzed for Cloud KMS separation of duties: principals simultaneously granted roles/cloudkms.admin and any of roles/cloudkms.cryptoKeyEncrypterDecrypter, roles/cloudkms.cryptoKeyEncrypter, or roles/cloudkms.cryptoKeyDecrypter.

Risk

Combining key management and key usage undermines confidentiality, integrity, and availability:

Unauthorized decryption of sensitive data
Tampering with policies or rotation to conceal access
Disabling or destroying keys, causing outages

This concentration of power reduces oversight and auditability.

Recommendation

Apply least privilege and separation of duties:

Never combine roles/cloudkms.admin with any roles/cloudkms.cryptoKey*
Isolate key management and usage in dedicated projects
Require approvals, log all key access, and monitor
Avoid broad roles/owner on key scopes

Remediation

CLI
Terraform
Dashboard steps

gcloud projects remove-iam-policy-binding <PROJECT_ID> --member=<MEMBER> --role=roles/cloudkms.admin

resource "google_project_iam_binding" "<example_resource_name>" {
  project = "<PROJECT_ID>"
  role    = "roles/cloudkms.admin" # Critical: ensure the offending principal is NOT bound as KMS Admin
  members = [
    "user:<ALLOWED_MEMBER_EMAIL>" # Critical: exclude any member who also has CryptoKey* roles to enforce separation of duties
  ]
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_role_kms_enforce_separation_of_duties. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Organization has Essential Contacts configured Service account roles enforce separation of duties

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires