Cloud KMS cryptokeys should prohibit anonymous and public access

It is recommended that the IAM policy on Cloud KMS cryptokeys should restrict anonymous and/or public access. The Powerpipe check looks for `allAuthenticatedUsers` and `allUsers` in the IAM policy bindings of each key.

What this control checks

Cloud KMS cryptokey IAM policy must not include allUsers or allAuthenticatedUsers as members.

Framework mappings

The clauses this control is mapped to in each framework.

SOC 2

CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.

PCI DSS v4.0

3.5.1: Primary account number (PAN) is secured wherever it is stored.
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
3.6.1: Cryptographic keys used to protect stored account data are secured.
3.6.1.2: Cryptographic keys used to protect stored account data are secured.

15 more clauses

3.6.1.3: Cryptographic keys used to protect stored account data are secured.
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
7.2.1: Access to system components and data is appropriately defined and assigned.
7.2.2: Access to system components and data is appropriately defined and assigned.
7.2.3: Access to system components and data is appropriately defined and assigned.
7.2.5: Access to system components and data is appropriately defined and assigned.
7.3.1: Access to system components and data is managed via an access control system(s).
7.3.2: Access to system components and data is managed via an access control system(s).
7.3.3: Access to system components and data is managed via an access control system(s).

ISO/IEC 27001:2022

A.8.12 Data leakage prevention
A.8.24 Use of cryptography

NIS2 Directive (EU 2022/2555)

9 Cryptography
11 Access control

NIST SP 800-53 Rev 5

AC-5 Separation Of Duties
AC-6: Least Privilege
Access Enforcement (AC-3)
Media Access (MP-2)

NIST Cybersecurity Framework v2.0

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
PR.AA-04
PR.DS-01

CIS GCP Benchmark v3.0.0

1.9 Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible

CIS GCP Benchmark v4.0.0

1.9 Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible

BSI C5:2025

CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents...
CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.

6 more clauses

CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
CRY-19.01B The cloud service provider implements procedures and technical safeguards to ensure the secure handling of cryptographic keys managed by cloud service customers. In these procedures, the following aspects are considered: - Secure integration of customer-managed keys into the cloud...
HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service...
IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.

CIS GCP Benchmark v1.2.0