Control: Ensure API keys are restricted to only APIs that application needs access

Description

API keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API keys to use (call) only APIs required by an application.

Usage

Run the control in your terminal:

powerpipe control run gcp_compliance.control.iam_api_key_restricts_apis

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run gcp_compliance.control.iam_api_key_restricts_apis --share

SQL

This control uses a named query:

  select
   'https://iam.googleapis.com/v1/projects/' || project || '/apikeys/' || name as resource,
  case
    when restrictions -> 'apiTargets' is null then 'alarm'
    else 'ok'
  end as status,
  case
    when restrictions -> 'apiTargets' is null then title || ' API key is not restricted to required APIs.'
    else title || ' API key is restricted to only required APIs.'
  end as reason
  , location as location, project as project
from
  gcp_apikeys_key;

Control: Ensure API keys are restricted to only APIs that application needs access

Description

Usage

SQL

Tags