Check ID: kms_key_not_publicly_accessible
Provider: GCP
Service: kms
Severity: HIGH
Categories: internet-exposed, identity-access
Resource type: cloudkms.googleapis.com/CryptoKey

​
What this check verifies

Cloud KMS crypto keys are evaluated for public principals in their IAM bindings, specifically allUsers and allAuthenticatedUsers. The finding reflects whether these memberships are present on a key.

​
Risk

Granting public principals access lets anyone on the Internet or any Google account use permissions on the key.
  • Confidentiality loss via unauthorized decrypt
  • Integrity compromise via illicit sign
  • Availability impact from disable, rotation, or destruction

​
Recommendation

Remove allUsers and allAuthenticatedUsers from key IAM. Grant access only to specific groups or service accounts with least privilege at the key scope. Enforce separation of duties between admins and users, and regularly review inherited bindings and audit logs.

​
Remediation

# Replace the IAM policy on the KMS key to remove any public members
resource "google_kms_crypto_key_iam_policy" "<example_resource_name>" {
  crypto_key_id = "<example_resource_id>"
  
  policy_data = jsonencode({
    bindings = [] # Critical: empty bindings remove all IAM principals, eliminating allUsers/allAuthenticatedUsers
  })
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = kms_key_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks