​
More Info:

KMS keys should be monitored to ensure that they are not overexposed i.e. there is at most a certain number of users associated with a key.

​
Risk Level

Medium

​
Address

Security

​
Compliance Standards

CBP

​
Remediation

​
Using Console

To remediate the misconfiguration “KMS Key Should Be Associated With Minimum Users” for GCP using GCP console, you can follow these steps:

  1. Go to the Google Cloud Console and select the project where the KMS key is located.
  2. In the navigation menu, select “Security” and then “Key Management”.
  3. Find the KMS key that needs to be updated and click on its name.
  4. In the “Permissions” tab, review the current users and service accounts that have access to the key.
  5. Remove any unnecessary users and service accounts from the key’s permissions list.
  6. Click on the “Add Member” button to add new users or service accounts to the key’s permissions list.
  7. Select the appropriate role for each user or service account, such as “Cloud KMS CryptoKey Encrypter/Decrypter” or “Cloud KMS CryptoKey Decrypter”.
  8. Click “Save” to apply the changes to the key’s permissions.

By following these steps, you can ensure that the KMS key is associated with the minimum number of users necessary, reducing the risk of unauthorized access to the key.

​
Using CLI

To remediate the misconfiguration “KMS Key Should Be Associated With Minimum Users” in GCP using GCP CLI, you can follow these steps:

  1. Open the GCP Cloud Shell and ensure that you have the necessary permissions to create and manage KMS keys.

  2. Identify the KMS key that is associated with more users than required. You can use the following command to list all the KMS keys in your project:

    gcloud kms keyrings list --location [LOCATION]

    Replace [LOCATION] with the location of your keyring.

  3. Once you have identified the KMS key, you can check the IAM policy associated with it using the following command:

    gcloud kms keys get-iam-policy [KEY-NAME] --location [LOCATION] --keyring [KEYRING-NAME]

    Replace [KEY-NAME], [LOCATION], and [KEYRING-NAME] with the name of your KMS key, the location of your keyring, and the name of your keyring, respectively.

  4. Review the IAM policy and identify the users who have access to the KMS key. Remove the unnecessary users from the IAM policy using the following command:

    gcloud kms keys remove-iam-policy-binding [KEY-NAME] --location [LOCATION] --keyring [KEYRING-NAME] --member [MEMBER] --role [ROLE]

    Replace [KEY-NAME], [LOCATION], and [KEYRING-NAME] with the name of your KMS key, the location of your keyring, and the name of your keyring, respectively. Replace [MEMBER] with the email address of the user that you want to remove from the IAM policy. Replace [ROLE] with the role that the user has in the IAM policy.

  5. Verify that the user has been removed from the IAM policy using the following command:

    gcloud kms keys get-iam-policy [KEY-NAME] --location [LOCATION] --keyring [KEYRING-NAME]

    Replace [KEY-NAME], [LOCATION], and [KEYRING-NAME] with the name of your KMS key, the location of your keyring, and the name of your keyring, respectively.

  6. Repeat steps 4-5 for all the unnecessary users who have access to the KMS key.

  7. Once you have removed all the unnecessary users from the IAM policy, verify that the KMS key is associated with the minimum required users.

By following these steps, you can remediate the misconfiguration “KMS Key Should Be Associated With Minimum Users” in GCP using GCP CLI.

​
Using Python

To remediate the KMS Key Should Be Associated With Minimum Users misconfiguration in GCP using Python, you can follow these steps:

  1. First, you need to identify the KMS key that has more than the minimum required number of users associated with it. You can use the Google Cloud KMS API to list all the keys and their associated users.
from google.oauth2 import service_account
from googleapiclient.discovery import build

# Set the credentials
creds = service_account.Credentials.from_service_account_file('path/to/key.json')

# Create the Cloud KMS API client
kms_client = build('cloudkms', 'v1', credentials=creds)

# List all the keys
keys = kms_client.projects().locations().keyRings().cryptoKeys().list(parent='projects/<project_id>/locations/<location>/keyRings/<key_ring_id>').execute()

# Iterate over all the keys
for key in keys['cryptoKeys']:
    # Get the number of users associated with the key
    num_users = len(key['iamPolicy']['bindings'])
    # Check if the number of users is greater than the minimum required
    if num_users > 1:
        # Print the key and the number of users
        print(f"Key {key['name']} has {num_users} users.")
  1. Once you have identified the keys that have more than the minimum required number of users, you need to remove the excess users from the key. You can use the same API to update the IAM policy of the key and remove the excess users.
# Set the key name
key_name = 'projects/<project_id>/locations/<location>/keyRings/<key_ring_id>/cryptoKeys/<key_id>'

# Set the minimum required number of users
min_users = 1

# Get the IAM policy for the key
iam_policy = kms_client.projects().locations().keyRings().cryptoKeys().getIamPolicy(resource=key_name).execute()

# Get the list of bindings for the key
bindings = iam_policy.get('bindings', [])

# Iterate over the bindings and remove the excess users
for binding in bindings:
    if binding['role'] == 'roles/cloudkms.cryptoKeyEncrypterDecrypter' and len(binding['members']) > min_users:
        excess_users = binding['members'][min_users:]
        for user in excess_users:
            binding['members'].remove(user)

# Update the IAM policy for the key
updated_policy = kms_client.projects().locations().keyRings().cryptoKeys().setIamPolicy(resource=key_name, body={'policy': iam_policy}).execute()
  1. Finally, you can verify that the excess users have been removed from the key by listing the keys and their associated users again.
# List all the keys
keys = kms_client.projects().locations().keyRings().cryptoKeys().list(parent='projects/<project_id>/locations/<location>/keyRings/<key_ring_id>').execute()

# Iterate over all the keys
for key in keys['cryptoKeys']:
    # Get the number of users associated with the key
    num_users = len(key['iamPolicy']['bindings'])
    # Check if the number of users is greater than the minimum required
    if num_users > 1:
        # Print the key and the number of users
        print(f"Key {key['name']} has {num_users} users.")

This should remediate the KMS Key Should Be Associated With Minimum Users misconfiguration in GCP.