KMS Key Should Be Associated With Minimum Users
More Info:
KMS keys should be monitored to ensure that they are not overexposed i.e. there is at most a certain number of users associated with a key.Risk Level
MediumAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “KMS Key Should Be Associated With Minimum Users” for GCP using GCP console, you can follow these steps:
- Go to the Google Cloud Console and select the project where the KMS key is located.
- In the navigation menu, select “Security” and then “Key Management”.
- Find the KMS key that needs to be updated and click on its name.
- In the “Permissions” tab, review the current users and service accounts that have access to the key.
- Remove any unnecessary users and service accounts from the key’s permissions list.
- Click on the “Add Member” button to add new users or service accounts to the key’s permissions list.
- Select the appropriate role for each user or service account, such as “Cloud KMS CryptoKey Encrypter/Decrypter” or “Cloud KMS CryptoKey Decrypter”.
- Click “Save” to apply the changes to the key’s permissions.
Using CLI
Using CLI
To remediate the misconfiguration “KMS Key Should Be Associated With Minimum Users” in GCP using GCP CLI, you can follow these steps:
- Open the GCP Cloud Shell and ensure that you have the necessary permissions to create and manage KMS keys.
-
Identify the KMS key that is associated with more users than required. You can use the following command to list all the KMS keys in your project:
Replace
[LOCATION]with the location of your keyring. -
Once you have identified the KMS key, you can check the IAM policy associated with it using the following command:
Replace
[KEY-NAME],[LOCATION], and[KEYRING-NAME]with the name of your KMS key, the location of your keyring, and the name of your keyring, respectively. -
Review the IAM policy and identify the users who have access to the KMS key. Remove the unnecessary users from the IAM policy using the following command:
Replace
[KEY-NAME],[LOCATION], and[KEYRING-NAME]with the name of your KMS key, the location of your keyring, and the name of your keyring, respectively. Replace[MEMBER]with the email address of the user that you want to remove from the IAM policy. Replace[ROLE]with the role that the user has in the IAM policy. -
Verify that the user has been removed from the IAM policy using the following command:
Replace
[KEY-NAME],[LOCATION], and[KEYRING-NAME]with the name of your KMS key, the location of your keyring, and the name of your keyring, respectively. - Repeat steps 4-5 for all the unnecessary users who have access to the KMS key.
- Once you have removed all the unnecessary users from the IAM policy, verify that the KMS key is associated with the minimum required users.
Using Python
Using Python
To remediate the KMS Key Should Be Associated With Minimum Users misconfiguration in GCP using Python, you can follow these steps:This should remediate the KMS Key Should Be Associated With Minimum Users misconfiguration in GCP.
- First, you need to identify the KMS key that has more than the minimum required number of users associated with it. You can use the Google Cloud KMS API to list all the keys and their associated users.
- Once you have identified the keys that have more than the minimum required number of users, you need to remove the excess users from the key. You can use the same API to update the IAM policy of the key and remove the excess users.
- Finally, you can verify that the excess users have been removed from the key by listing the keys and their associated users again.