Google Cloud Compliance ControlsGoogle Cloud KMS
Cloud KMS encryption keys should limit users to 3
Checks that each Cloud KMS encryption key has three or fewer users. Keys with more than three users fail the check, and the recommendation is to limit the users of each KMS encryption key to three at most.
What this control checks
Cloud KMS encryption keys should limit users to 3
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-04
- PR.DS-01
- 3.5.2 Restrict access to cryptographic keys to the fewest number of custodians necessary
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kms_key_users_limited_to_3 - Powerpipe Control:
gcp_compliance.control.kms_key_users_limited_to_3
Last reviewed: 2026-10-09