API key is restricted to specific Google APIs when the Gemini (Generative Language) API is enabled
apikeys_api_restricted_with_gemini_api
The Gemini API (a.k.a. Generative Language API, generativelanguage.googleapis.com) uses API keys to authenticate requests for uploaded files and cached content. For projects with the Gemini API enabled, each API key should have API restrictions configured to limit access to specific services.
Risk
Leaked, unrestricted API keys allow access to sensitive uploaded files and cached content, impacting their confidentiality. The risk of leaks is particularly high because traditionally, Google API keys were not considered sensitive and might be embedded in website source code, mobile apps, etc.
prowler gcp --checks apikeys_api_restricted_with_gemini_api
Recommendation
Apply API restrictions so that each key only has access to specific APIs. Do not allow access to the "Generative Language API" in particular. If access to the "Generative Language API" is required, be aware of the consequences. Only use the key for this specific purpose and ensure adequate secrets storage.
Alternatively, completely disable the Gemini API (a.k.a. Generative Language API, generativelanguage.googleapis.com) in the project's enabled services.
Remediation
gcloud services api-keys update <KEY_ID> --api-target=service=<SERVICE_NAME>
- In Google Cloud Console, go to APIs & Services > Credentials
- Click the API key name to edit it
- In API restrictions, select "Restrict key"
- Choose only the specific API(s) needed (do not select "All Google APIs" and select "Generative Language API" only if specifically required)
- Click Save
Source Code
Resource Type
apikeys.googleapis.com/Key
References
Depends On
- apikeys_api_restrictions_configured