Description

Ensure that the Gemini API (Generative Language API, generativelanguage.googleapis.com) is disabled for projects that do not have an approved business need to use it, so that unrestricted API keys in the project cannot be used to authenticate Gemini API requests.

Rationale

Once the Generative Language API is enabled on a project, any API key in that project, even one created for an unrelated purpose, can potentially be used to authenticate Gemini API requests unless it has been explicitly restricted. For projects that have no legitimate need for Gemini API access, disabling the API entirely removes this exposure at the source, providing a simpler and more robust control than relying on every individual API key being correctly restricted.

Impact

  • Eliminates the risk of unrestricted API keys in the project being used to call the Gemini API

  • Removes an unused attack surface and dependency for projects with no legitimate Gemini API use case

  • Breaks any legitimate application, script, or integration in the project that does rely on the Gemini API, so this must be confirmed before disabling

Default Value

The Generative Language API is not enabled by default in new projects; it must be explicitly enabled, either directly or as a dependency of another enabled service.

Pre-Requisites

  • Confirmation from application owners that no workload in the project legitimately depends on the Gemini API

  • IAM permissions to enable and disable APIs (e.g., Service Usage Admin)

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to APIs & Services > Enabled APIs & Services.

  4. Search for Generative Language API in the list.

  5. Verify whether the API is currently enabled.

  6. If the API is enabled without an approved business justification, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to APIs & Services > Enabled APIs & Services.

  4. Search for and select Generative Language API.

  5. Select Disable API.

  6. Confirm the action in the dialog that appears, acknowledging that dependent resources may be affected.

  7. Verify the API no longer appears in the Enabled APIs & Services list.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to APIs & Services > Library.

  4. Search for Generative Language API and select it.

  5. Select Enable.

  6. If access is required, ensure all API keys in the project are subsequently reviewed and restricted appropriately to avoid unintended exposure.

Reference