Google Cloud Compliance ControlsGoogle Cloud IAM
IAM users should not hold both KMS admin and KMS key user roles
Recommends that the principle of 'Separation of Duties' is enforced when assigning `KMS` related roles to users. The recommendation concerns how `KMS` related roles are assigned to individual users, so that the principle is applied to those assignments.
What this control checks
Checks that KMS separation of duty is enforced for IAM users
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions.
- PR.AA-05
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_user_kms_separation_of_duty_enforced - Powerpipe Control:
gcp_compliance.control.iam_user_kms_separation_of_duty_enforced
Last reviewed: 2026-10-09