Cloud KMS cryptokeys should prohibit anonymous and public access

It is recommended that the IAM policy on Cloud KMS cryptokeys should restrict anonymous and/or public access. The Powerpipe check looks for `allAuthenticatedUsers` and `allUsers` in the IAM policy bindings of each key.

Broad access to a KMS key enables unauthorized data-key generation, breaking confidentiality. With admin rights, attackers can change policies or schedule deletion, undermining control integrity and threatening availability of data dependent on the key.

What this control checks

Cloud KMS cryptokey IAM policy must not include allUsers or allAuthenticatedUsers as members.

Common pitfalls

Check returns UNKNOWN without IAM member keys

The Checkov check returns UNKNOWN when policy_data, members and member are all absent. It evaluates only the keys member, members and policy_data.

Audit evidence

Evidence that deployed resources meet this control: Prowler check kms_key_not_publicly_accessible (prowler gcp --checks kms_key_not_publicly_accessible); PowerPipe control gcp_compliance.control.kms_key_not_publicly_accessible.

Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_112.

Framework-specific interpretation

SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...), CC6.3 (The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets...) and CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).

PCI DSS v4.0: Mapped to 3.5.1 (Primary account number (PAN) is secured wherever it is stored.), 3.5.1.1 (Primary account number (PAN) is secured wherever it is stored.), 3.5.1.3 (Primary account number (PAN) is secured wherever it is stored.) and 17 more clauses.

ISO/IEC 27001:2022: Mapped to A.8.12 (Data Leakage Prevention) and A.8.24 (Use of Cryptography).

NIS2 Directive (EU 2022/2555): Mapped to 11.4.2.c (protect access to system administration systems through authentication and encryption.), 11.6.1 (The relevant entities shall implement secure authentication procedures and technologies based on access restrictions...), 9.2.c (the relevant entities approach to key management, including, where appropriate, methods for the following:) and 4 more clauses.

NIST SP 800-53 Rev 5: Mapped to AC-3 (Account Management), AC-5 (Separation Of Duties), AC-6 (Least Privilege) and 1 more clause.

NIST Cybersecurity Framework v2.0: Mapped to PR.AA-01 (Identities and credentials for authorized users, services, and hardware are managed by the organization.), PR.AA-04 (Identity assertions are protected, conveyed, and verified.) and PR.DS-01 (The confidentiality, integrity, and availability of data-at-rest are protected.).

Framework mappings

The clauses this control is mapped to in each framework.

SOC 2

CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.

PCI DSS v4.0

3.5.1: Primary account number (PAN) is secured wherever it is stored.
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
3.6.1: Cryptographic keys used to protect stored account data are secured.
3.6.1.2: Cryptographic keys used to protect stored account data are secured.

15 more clauses

3.6.1.3: Cryptographic keys used to protect stored account data are secured.
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
7.2.1: Access to system components and data is appropriately defined and assigned.
7.2.2: Access to system components and data is appropriately defined and assigned.
7.2.3: Access to system components and data is appropriately defined and assigned.
7.2.5: Access to system components and data is appropriately defined and assigned.
7.3.1: Access to system components and data is managed via an access control system(s).
7.3.2: Access to system components and data is managed via an access control system(s).
7.3.3: Access to system components and data is managed via an access control system(s).

ISO/IEC 27001:2022

A.8.12 Data leakage prevention
A.8.24 Use of cryptography

NIS2 Directive (EU 2022/2555)

9 Cryptography
11 Access control

NIST SP 800-53 Rev 5

AC-5 Separation Of Duties
AC-6: Least Privilege
Access Enforcement (AC-3)
Media Access (MP-2)

NIST Cybersecurity Framework v2.0

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
PR.AA-04
PR.DS-01

CIS GCP Benchmark v3.0.0

1.9 Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible

CIS GCP Benchmark v4.0.0

1.9 Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible

BSI C5:2025

CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents...
CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.

6 more clauses

CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
CRY-19.01B The cloud service provider implements procedures and technical safeguards to ensure the secure handling of cryptographic keys managed by cloud service customers. In these procedures, the following aspects are considered: - Secure integration of customer-managed keys into the cloud...
HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service...
IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.

CIS GCP Benchmark v1.2.0