# 1.9 Ensure Cloud KMS Cryptokeys Are Not Accessible to Anonymous or Public Users (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232904-1-9-ensure-cloud-kms-cryptokeys-are-not-accessible-to-anonymous-or-public-users-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) # Profile Applicability: # Level 1 # Description: The IAM policies for Cloud KMS cryptokeys should be configured to prevent access by allUsers or allAuthenticatedUsers to ensure cryptographic keys are not accessible by anonymous or public users. # Rationale: Granting access to allUsers or allAuthenticatedUsers can expose cryptographic keys to unauthorized individuals or systems, leading to potential misuse or compromise. Preventing public or anonymous access is critical when managing sensitive data secured by cryptographic keys. # Impact: Removing access for allUsers or allAuthenticatedUsers will deny access to public or anonymous users. Ensure that legitimate users or services requiring access have appropriate roles assigned. # Default Value: By default, Cloud KMS cryptokeys do not allow access to allUsers or allAuthenticatedUsers. # Remediation Steps: Test Plan: Using Google Cloud CLI: List all Cloud KMS cryptographic keys:  gcloud kms keys list --keyring=\[key\_ring\_name\] --location=global --format=json | jq '.\[\].name' Check the IAM policy for each key to verify no allUsers or allAuthenticatedUsers access: gcloud kms keys get-iam-policy \[key\_name\] --keyring=\[key\_ring\_name\] --location=global --format=json | jq '.bindings\[\].members\[\]' 1. Ensure that allUsers or allAuthenticatedUsers are not listed in the output. # Implementation: Using Google Cloud CLI: List all cryptographic keys: gcloud kms keys list --keyring=\[key\_ring\_name\] --location=global --format=json | jq '.\[\].name' Remove any IAM policy bindings that grant access to allUsers or allAuthenticatedUsers: gcloud kms keys remove-iam-policy-binding \[key\_name\] \\ --keyring=\[key\_ring\_name\] --location=global \\ --member='allAuthenticatedUsers' --role='\[role\]' gcloud kms keys remove-iam-policy-binding \[key\_name\] \\ --keyring=\[key\_ring\_name\] --location=global \\ --member='allUsers' --role='\[role\]' ## Backout Plan: 1\. Restore Access (If Necessary) If removing public access impacts a valid service, reassign access: gcloud kms keys add-iam-policy-binding \[KEY\_NAME\] \\--keyring=\[KEY\_RING\_NAME\] --location=global \\ --member="serviceAccount:my-service-account@my-project.iam.gserviceaccount.com" \\ --role="roles/cloudkms.cryptoKeyEncrypterDecrypter" 2\. Restore IAM Policy from Backup If needed, restore a previous IAM policy: gcloud kms keys set-iam-policy \[KEY\_NAME\] policy-backup.json # References: 1. [Setting IAM Policy for KMS Keys](https://cloud.google.com/sdk/gcloud/reference/kms/keys/set-iam-policy) 2. [Getting IAM Policy for KMS Keys](https://cloud.google.com/sdk/gcloud/reference/kms/keys/get-iam-policy) 3. [Cloud KMS Key Resource Hierarchy](https://cloud.google.com/kms/docs/object-hierarchy#key_resource_id) # CIS Controls:

Control

Description

IG 1

IG 2

IG 3

3.3 Configure Data Access Control Lists

Apply access control lists to enforce the principle of least privilege, granting access only as needed.

✅

✅

✅

14.6 Protect Information Through ACLs

Use ACLs to ensure only authorized individuals have access to sensitive information.

✅

✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.