Ensure Cloud KMS cryptokeys are not anonymously or publicly accessible

From Google Cloud CLI

1. List all Cloud KMS Cryptokeys.

gcloud kms keys list --keyring=<keyRingName> --location=global --format=json | jq '.[].name'

1. Remove IAM policy binding for a KMS key to remove access to allUsers and allAuthenticatedUsers using the below command.

gcloud kms keys remove-iam-policy-binding <keyName> --keyring=<keyRingName> --location=global --member='allAuthenticatedUsers' --role='<role>'

gcloud kms keys remove-iam-policy-binding <keyName> --keyring=<keyRingName> --location=global --member='allUsers' --role='<role>'

Default Value

By default Cloud KMS does not allow access to allUsers or allAuthenticatedUsers.

References

1. https://cloud.google.com/sdk/gcloud/reference/kms/keys/remove-iam-policy-binding
2. https://cloud.google.com/sdk/gcloud/reference/kms/keys/set-iam-policy
3. https://cloud.google.com/sdk/gcloud/reference/kms/keys/get-iam-policy
4. https://cloud.google.com/kms/docs/object-hierarchy#key_resource_id

Google Cloud Console (Asset-Level)

1. Open the affected project/resource from the finding details in Google Cloud Console.
2. Navigate to the resource security/configuration settings.
3. Apply the control-specific secure configuration.
4. Save and re-run the check.

Multiple Remediation Paths

Google Cloud

SERVICE-WIDE (RECOMMENDED when many resources are affected): Enforce Organization Policies at org/folder level so new resources inherit secure defaults.

gcloud org-policies set-policy policy.yaml

ASSET-LEVEL: Use the product-specific remediation steps above for only the impacted project/resources.

PREVENTIVE: Use org policy constraints/custom constraints and enforce checks in deployment pipelines.

References for Service-Wide Patterns

• GCP Organization Policy overview: https://cloud.google.com/resource-manager/docs/organization-policy/overview
• GCP Organization policy constraints catalog: https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
• gcloud org-policies: https://cloud.google.com/sdk/gcloud/reference/org-policies

Operational Rollout Workflow

Use this sequence to reduce risk and avoid repeated drift.

1. Contain at Service-Wide Scope First (Recommended)

• Google Cloud: apply organization policy constraints at org/folder scope.

gcloud org-policies set-policy policy.yaml

2. Remediate Existing Affected Assets

• Execute the control-specific Console/CLI steps documented above for each flagged resource.
• Prioritize internet-exposed and production assets first.

3. Validate and Prevent Recurrence

• Re-scan after each remediation batch.
• Track exceptions with owner and expiry date.
• Add preventive checks in IaC/CI pipelines.