Cloud KMS crypto keys are evaluated for public principals in their IAM bindings, specifically allUsers and allAuthenticatedUsers.
The finding reflects whether these memberships are present on a key.
Risk
Granting public principals access lets anyone on the Internet or any Google account use permissions on the key.
- Confidentiality loss via unauthorized
decrypt - Integrity compromise via illicit
sign - Availability impact from disable, rotation, or destruction
Run this check with Prowler CLI
prowler gcp --checks kms_key_not_publicly_accessible
Recommendation
Remove allUsers and allAuthenticatedUsers from key IAM. Grant access only to specific groups or service accounts with least privilege at the key scope. Enforce separation of duties between admins and users, and regularly review inherited bindings and audit logs.
Remediation
Terraform
Other
- In Google Cloud Console, go to Security > Key Management > Key rings
- Open the key ring, then select the affected key
- Click the Permissions tab
- Remove principals "allUsers" and "allAuthenticatedUsers" from all roles
- Click Save
Source Code
Resource Type
cloudkms.googleapis.com/CryptoKey