# 1.14 Ensure API Keys Are Restricted to Only APIs Required by the Application (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232919-114-ensure-api-keys-are-restricted-to-only-apis-required-by-the-application-automated - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-06-16 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability:Level 2 ### Description: API keys should be limited to accessing only the APIs necessary for the application’s functionality. Unrestricted API keys can expose all Google Cloud APIs, increasing the risk of unauthorized access and misuse. It is recommended to restrict API key usage to specific APIs required by the application. ### Rationale: The use of API keys poses several security risks: - Simple encrypted strings: API keys can be easily discovered and stolen if exposed in client environments like browsers or mobile devices. - No identification: API keys do not identify users or applications, limiting accountability. - Broad access: Unrestricted keys can call any Google Cloud API, increasing the risk of misuse. Google recommends using standard authentication methods whenever possible. For limited cases where API keys are required (e.g., mobile apps using the Translation API without a backend), applying API restrictions minimizes attack surfaces. ### Impact: Setting API restrictions may disrupt application functionality if not carefully configured. Ensure that API keys are restricted to only the APIs required for proper application operation. ### Default Value: By default, API restrictions are set to "None," allowing unrestricted access to all APIs. ### Audit Steps: Using Google Cloud Console: 1. Navigate to APIs & Services > Credentials: [GCP Credentials Console](https://console.cloud.google.com/apis/credentials).                                 ![](https://support.icompaas.com/assets/kb/d3e917c256bef49a.png) 2. For each API key: - Click the API Key Name to view its properties.                      ![](https://support.icompaas.com/assets/kb/bde4fd64029a71e9.png) - Verify that the Key restrictions section under API restrictions is not set to "None."                                       ![](https://support.icompaas.com/assets/kb/1d46510800a96c0d.png) - Ensure it is not set to Google Cloud APIs, which allows access to all APIs. Using Google Cloud CLI: List all API keys for the project:  gcloud services api-keys list 1. Check for unrestricted keys: - Verify that the restrictions: parameter is present for each key. - Ensure the apiTargets parameter does not include service: cloudapis.googleapis.com, which grants access to all APIs. ### Remediation Steps: Using Google Cloud Console: 1. Navigate to APIs & Services > Credentials: [GCP Credentials Console](https://console.cloud.google.com/apis/credentials). 2. For each API key: - Click the API Key Name to open its properties.                  ![](https://support.icompaas.com/assets/kb/b81fd2473533c3e5.png) - Under Key restrictions, go to the API restrictions section.                                              ![](https://support.icompaas.com/assets/kb/d8e4d7d37d33b79f.png) - Click Select API and choose the required API(s) from the dropdown menu.                                        ![](https://support.icompaas.com/assets/kb/24136505c346a01a.png) - Save the changes.                                       ![](https://support.icompaas.com/assets/kb/0754bdd352a1da39.png) Using Google Cloud CLI: List all API keys:  gcloud services api-keys list Update the API restrictions for a key: gcloud alpha services api-keys update --api-targets=service= Example: gcloud alpha services api-keys update --api-targets=service=translate.googleapis.com ## Backout Plan: 1\. Restore API Key Restrictions (If Necessary) If an API key needs broader access temporarily, remove restrictions: gcloud alpha services api-keys update --api-targets=service=cloudapis.googleapis.com Use with caution! 2\. Restore IAM Policy from Backup If needed, restore a previous IAM policy: gcloud projects set-iam-policy PROJECT\_ID policy-backup.json References: 1. [Using API Keys for Authentication](https://cloud.google.com/docs/authentication/api-keys) 2. [Overview of Google Cloud APIs](https://cloud.google.com/apis/docs/overview) 3. [Updating API Key Restrictions](https://cloud.google.com/sdk/gcloud/reference/alpha/services/api-keys/update) ### CIS Controls:

Control

Description

IG 1

IG 2

IG 3

16.10 Apply Secure Design Principles

Enforce secure design principles, including least privilege, to minimize the attack surface in application architectures.

✅

✅

❌

Explicitly Not Mapped

Not explicitly mapped in CIS v7 controls.

❌

❌

❌

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.