# 1.11 Ensure Separation of Duties Is Enforced When Assigning KMS Roles to Users (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232905-111-ensure-separation-of-duties-is-enforced-when-assigning-kms-roles-to-users-automated - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-06-16 - Publisher: iCompaas, Inc. (https://www.icompaas.com) # Profile Applicability:Level 2 # Description: The principle of Separation of Duties should be applied when assigning roles related to Google Cloud Key Management Service (KMS). Users should not be granted both administrative and operational roles simultaneously to minimize security risks. # Rationale: The following roles in Cloud KMS provide varying levels of access: - Cloud KMS Admin: Allows users to create, delete, and manage keys. - Cloud KMS CryptoKey Encrypter/Decrypter: Allows encryption and decryption of data using keys. - Cloud KMS CryptoKey Encrypter: Allows encryption only. - Cloud KMS CryptoKey Decrypter: Allows decryption only. Assigning administrative roles (e.g., Cloud KMS Admin) alongside operational roles (e.g., CryptoKey Encrypter/Decrypter) to the same user violates the principle of Separation of Duties. This increases the risk of unauthorized access to sensitive data or misuse of encryption keys. Separation of Duties is essential in larger organizations to reduce the likelihood of malicious activities or errors and is considered a best practice for securing cryptographic systems. # Impact: Removing conflicting roles from a single user may require reassigning these roles to other users to maintain operational functionality. # Default Value: By default, users are not assigned both administrative and operational roles in Cloud KMS. # Remediation Steps: Using Google Cloud Console: 1. Navigate to IAM & Admin > IAM: [IAM Console](https://console.cloud.google.com/iam-admin/iam).                                          ![](https://support.icompaas.com/assets/kb/48f00cceeebc2173.png) 2. Review the list of members with roles.                           ![](https://support.icompaas.com/assets/kb/1437a0a96f6561d0.png) 3. Ensure no user has both the Cloud KMS Admin role and any of the following roles simultaneously: - Cloud KMS CryptoKey Encrypter/Decrypter - Cloud KMS CryptoKey Encrypter - Cloud KMS CryptoKey Decrypter Using Google Cloud CLI: Retrieve the IAM policy for the project:  gcloud projects get-iam-policy PROJECT\_ID --format json 1. Check for users assigned conflicting roles: - Cloud KMS Admin: roles/cloudkms.admin - CryptoKey Roles: - roles/cloudkms.cryptoKeyEncrypterDecrypter - roles/cloudkms.cryptoKeyEncrypter - roles/cloudkms.cryptoKeyDecrypter 2. Ensure no user is listed under both categories. # Implementation: Using Google Cloud Console: 1. Navigate to IAM & Admin > IAM: [IAM Console](https://console.cloud.google.com/iam-admin/iam).                                            ![](https://support.icompaas.com/assets/kb/c951b937b40d38a3.png) 2. Identify users with conflicting roles. 3. Remove one of the roles by clicking the Delete (Trash) icon based on business requirements.                                  ![](https://support.icompaas.com/assets/kb/32109766143cb338.png) Using Google Cloud CLI: Retrieve the IAM policy and save it to a file: gcloud projects get-iam-policy PROJECT\_ID --format json > iam.json Edit the iam.json file to remove conflicting roles for users. Example: { "bindings": \[ { "role": "roles/cloudkms.admin", "members": \[ "user:example-user@example.com" \] } \], "etag": "BwUjMhCsNvY=" } Update the IAM policy with the modified file:  gcloud projects set-iam-policy PROJECT\_ID iam.json ## Backout Plan: 1\. Reassign Necessary Roles (If Required) If a user needs access, reassign roles appropriately: gcloud projects add-iam-policy-binding PROJECT\_ID \\ --member="user:example@yourcompany.com" \\ --role="roles/cloudkms.cryptoKeyEncrypter" 2\. Restore IAM Policy from Backup If necessary, restore a previous IAM policy: gcloud projects set-iam-policy PROJECT\_ID backup-iam.json References: 1. [Separation of Duties for KMS](https://cloud.google.com/kms/docs/separation-of-duties) # Additional Information: - Users with Owner (roles/owner) or Editor (roles/editor) roles have equivalent permissions to Cloud KMS Admin and operational roles. These elevated roles should be granted sparingly. - Use custom roles to enforce specific permissions if required. # CIS Controls:

Control

Description

IG 1

IG 2

IG 3

3.3 Configure Data Access Control Lists

Apply ACLs to enforce least privilege, ensuring access is granted only as needed.

✅

✅

✅

14.6 Protect Information Through ACLs

Use ACLs to safeguard sensitive information, limiting access to authorized users based on responsibilities.

✅

✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.