> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Cloud kms cryptokeys not publicly accessible remediation ### Triage and Remediation ### Remediation Sure, here are the step-by-step instructions to remediate the "KMS Cryptokeys Should Not Be Public" misconfiguration in GCP using the GCP console: 1. Open the GCP console and navigate to the "Cloud KMS" page. 2. Select the key ring that contains the public key that needs to be remediated. 3. Click on the key that contains the public key that needs to be remediated. 4. Click on the "Permissions" tab. 5. Under the "Members" section, locate the user or group that has public access to the key. 6. Click on the drop-down menu next to the user or group and select "Remove". 7. Click on the "Save" button to save the changes. 8. Repeat steps 5-7 for any other users or groups that have public access to the key. 9. Once all public access has been removed, click on the "IAM" tab. 10. Check the IAM policies for the key and ensure that only authorized users or groups have access. 11. Remove any unnecessary or overly permissive IAM policies. 12. Click on the "Save" button to save the changes. By following these steps, you will have successfully remediated the "KMS Cryptokeys Should Not Be Public" misconfiguration in GCP using the GCP console. # To remediate the KMS Cryptokeys Should Not Be Public issue for GCP using GCP CLI, please follow these steps: 1. Open the Cloud Shell in your GCP console. 2. Run the following command to list all the KMS keys in your project: ``` gcloud kms keys list --location=global --keyring= ``` Replace `` with the name of the keyring containing the keys you want to check. 3. Identify the key(s) that have the `public` key policy set. 4. Run the following command to remove the `public` key policy from the identified key(s): ``` gcloud kms keys set-iam-policy ``` Replace `` with the name of the identified key and `` with the path to a file containing the new IAM policy for the key. Here's an example of a new IAM policy that removes the `public` key policy: ``` { "bindings": [ { "role": "roles/cloudkms.cryptoKeyEncrypterDecrypter", "members": [ "serviceAccount:" ] } ] } ``` Replace `` with the email address of a service account that needs access to the key. 5. Verify that the `public` key policy has been removed from the identified key(s) by running the following command: ``` gcloud kms keys get-iam-policy ``` Replace `` with the name of the identified key. This should return the new IAM policy that you set in step 4 without the `public` key policy. 6. Repeat steps 3-5 for any other identified keys that have the `public` key policy set. Once you have completed these steps, your KMS Cryptokeys should no longer be public. To remediate the misconfiguration "KMS Cryptokeys Should Not Be Public" in GCP using Python, you can follow the below steps: 1. First, you need to check if there are any publicly exposed KMS Cryptokeys in your GCP project. You can use the following Python code to list all the KMS Cryptokeys in your project: ```python theme={null} from google.cloud import kms_v1 client = kms_v1.KeyManagementServiceClient() project_id = 'your-project-id' parent = f'projects/{project_id}' # List all the KMS Cryptokeys in the project response = client.list_crypto_keys(parent) for crypto_key in response.crypto_keys: print(crypto_key.name) ``` 2. Once you have the list of all the KMS Cryptokeys in your project, you need to check if any of them are public. You can use the following Python code to check if a KMS Cryptokey is public: ```python theme={null} from google.cloud import kms_v1 client = kms_v1.KeyManagementServiceClient() key_name = 'projects/your-project-id/locations/global/keyRings/your-keyring/cryptoKeys/your-cryptokey' # Get the KMS Cryptokey IAM policy response = client.get_iam_policy(key_name) # Check if any member has 'roles/cloudkms.cryptoKeyEncrypterDecrypter' role for binding in response.bindings: if 'roles/cloudkms.cryptoKeyEncrypterDecrypter' in binding['role']: if 'allUsers' in binding['members'] or 'allAuthenticatedUsers' in binding['members']: print(f"The KMS Cryptokey {key_name} is public.") ``` 3. If you find any publicly exposed KMS Cryptokeys, you need to remove the public access. You can use the following Python code to remove public access from a KMS Cryptokey: ```python theme={null} from google.cloud import kms_v1 client = kms_v1.KeyManagementServiceClient() key_name = 'projects/your-project-id/locations/global/keyRings/your-keyring/cryptoKeys/your-cryptokey' # Get the KMS Cryptokey IAM policy policy = client.get_iam_policy(key_name) # Remove the 'roles/cloudkms.cryptoKeyEncrypterDecrypter' role from 'allUsers' and 'allAuthenticatedUsers' for binding in policy.bindings: if 'roles/cloudkms.cryptoKeyEncrypterDecrypter' in binding['role']: if 'allUsers' in binding['members']: binding['members'].remove('allUsers') if 'allAuthenticatedUsers' in binding['members']: binding['members'].remove('allAuthenticatedUsers') # Update the KMS Cryptokey IAM policy update_mask = {'paths': ['bindings']} client.set_iam_policy(key_name, policy, update_mask) ``` By following the above steps, you can remediate the misconfiguration "KMS Cryptokeys Should Not Be Public" in GCP using Python. ```hcl theme={null} # KMS crypto key resource (existing) resource "google_kms_crypto_key" "crypto_key" { name = "CRYPTO_KEY_NAME" # e.g. "my-key" key_ring = "projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING_NAME" purpose = "ENCRYPT_DECRYPT" } # IAM binding for the key – authoritative for this role. # IMPORTANT: Do NOT include "allUsers" or "allAuthenticatedUsers" in members. resource "google_kms_crypto_key_iam_binding" "crypto_key_user_binding" { crypto_key_id = google_kms_crypto_key.crypto_key.id role = "roles/cloudkms.cryptoKeyEncrypterDecrypter" members = [ "user:ALLOWED_USER_EMAIL", # replace with allowed user, e.g. "user:alice@example.com" "serviceAccount:ALLOWED_SA_EMAIL", # replace with allowed SA, e.g. "serviceAccount:app@PROJECT_ID.iam.gserviceaccount.com" # remove any "allUsers" or "allAuthenticatedUsers" entries that were here before ] } ``` This Terraform configuration removes anonymous/public access by managing the IAM binding for the KMS cryptokey and ensuring no `allUsers` or `allAuthenticatedUsers` members are present; it does not force replacement of the cryptokey itself but will update its IAM policy (which may revoke existing access for those principals). For verification, `terraform plan` should show an in-place update to `google_kms_crypto_key_iam_binding.crypto_key_user_binding` with the `members` list changing to no longer include `allUsers`/`allAuthenticatedUsers`.