Google Cloud Compliance ControlsGoogle Cloud API Keys
API keys should have rotation configured every 90 days
Google Cloud API keys are evaluated for rotation age using their creation_time. Keys created within the last 90 days are treated as recently rotated. Keys older than 90 days are treated as overdue. It is recommended to rotate API keys every 90 days.
What this control checks
API keys must be no older than 90 days; older keys fail
Framework mappings
The clauses this control is mapped to in each framework.
- 8.3.5: Strong authentication for users and administrators is established and managed.
- A.5.16 Identity management
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 11 Access control
- 12 Asset management
- PL-8 Information Security Architecture
- SA-8 Security Engineering Principles
NIST Cybersecurity Framework v2.0
- DE.CM-03
- GV.RM-02: Risk appetite and risk tolerance statements are established, communicated, and maintained.
- GV.RM-04: Strategic direction that describes appropriate risk response options is established and communicated.
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
2 more clauses
- PR.AA-03
- PR.AA-05
- 1.15 Ensure API Keys Are Rotated Every 90 Days
- 1.15 Ensure API Keys Are Rotated Every 90 Days
- CRY-07.01B The cloud service provider has established a schedule for rotating cryptographic keys that aligns with the requirements for cryptographic key rotation established in CRY-01. If, based on the results of a risk analysis, the cloud service provider does not perform key rotation, this...
- CRY-09.02B Provisioned keys include activation and deactivation dates to ensure that their use is time limited.
- CRY-11.01B The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to...
- DEV-12.02B Unless unavoidable, the cloud service provider does not reuse the cryptographic secret and private keys and other secrets used in production environments in other, non-production environments. Any unavoidable reuse of the cryptographic secret and private keys between production and...
- IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-...
1 more clause
- PSS-05.01B The cloud service provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility. These authentication mechanisms are set up at all access points that...
- 1.15 Ensure API keys are rotated every 90 days
- 1.15 Ensure API keys are rotated every 90 days
- 1.15 Ensure API keys are rotated every 90 days
NIST Cybersecurity Framework v1.0
- PR.IP-2: A System Development Life Cycle to manage systems is implemented.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_api_key_age_90 - Powerpipe Control:
gcp_compliance.control.iam_api_key_age_90 - Prowler Check:
apikeys_key_rotated_in_90_days
Last reviewed: 2026-10-09