Control: Ensure API keys are restricted to use by only specified Hosts and Apps
Description
Unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps.
Usage
Run the control in your terminal:
powerpipe control run gcp_compliance.control.iam_api_key_restricts_websites_hosts_appsSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run gcp_compliance.control.iam_api_key_restricts_websites_hosts_apps --shareSQL
This control uses a named query:
iam_api_key_restricts_websites_hosts_apps