Google Cloud Compliance ControlsGoogle Cloud API Keys
Projects should not use API keys
Prowler evaluates each project for active `API keys`. It does this by determining whether any keys exist and are enabled in the project, so the evaluation looks at both the presence of keys and their enabled state within that project.
What this control checks
Fails if the project has any API keys (gcp_apikeys_key count above 0); passes with none.
Framework mappings
The clauses this control is mapped to in each framework.
- 9 Cryptography
- PL-8 Information Security Architecture
- SA-8 Security Engineering Principles
- 1.12 Ensure API Keys Only Exist for Active Services
- 1.12 Ensure API Keys Only Exist for Active Services
- PSS-05.01B The cloud service provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility. These authentication mechanisms are set up at all access points that...
- 1.12 API Keys should only be used for services in cases where other authentication methods are unavailable. Unused keys with their permissions in tact may still exist within a project. Keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed...
NIST Cybersecurity Framework v1.0
- PR.IP-2: A System Development Life Cycle to manage systems is implemented.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
project_no_api_key - Powerpipe Control:
gcp_compliance.control.project_no_api_key - Prowler Check:
apikeys_key_exists
Last reviewed: 2026-10-09