# Ensure Gemini (Generative Language) API is Disabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1788888303688124-ensure-gemini-generative-language-api-is-disabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that the Gemini API (Generative Language API, generativelanguage.googleapis.com) is disabled for projects that do not have an approved business need to use it, so that unrestricted API keys in the project cannot be used to authenticate Gemini API requests.

**Rationale**

Once the Generative Language API is enabled on a project, any API key in that project, even one created for an unrelated purpose, can potentially be used to authenticate Gemini API requests unless it has been explicitly restricted. For projects that have no legitimate need for Gemini API access, disabling the API entirely removes this exposure at the source, providing a simpler and more robust control than relying on every individual API key being correctly restricted.

**Impact**

-   Eliminates the risk of unrestricted API keys in the project being used to call the Gemini API
    
-   Removes an unused attack surface and dependency for projects with no legitimate Gemini API use case
    
-   Breaks any legitimate application, script, or integration in the project that does rely on the Gemini API, so this must be confirmed before disabling
    

**Default Value**

The Generative Language API is not enabled by default in new projects; it must be explicitly enabled, either directly or as a dependency of another enabled service.

**Pre-Requisites**

-   Confirmation from application owners that no workload in the project legitimately depends on the Gemini API
    
-   IAM permissions to enable and disable APIs (e.g., Service Usage Admin)
    

**Test Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to APIs & Services > Enabled APIs & Services.
    
4.  Search for Generative Language API in the list.
    
5.  Verify whether the API is currently enabled.
    
6.  If the API is enabled without an approved business justification, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to APIs & Services > Enabled APIs & Services.
    
4.  Search for and select Generative Language API.
    
5.  Select Disable API.
    
6.  Confirm the action in the dialog that appears, acknowledging that dependent resources may be affected.
    
7.  Verify the API no longer appears in the Enabled APIs & Services list.
    

**Backout Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to APIs & Services > Library.
    
4.  Search for Generative Language API and select it.
    
5.  Select Enable.
    
6.  If access is required, ensure all API keys in the project are subsequently reviewed and restricted appropriately to avoid unintended exposure.
    

**Reference**

-   [https://hub.prowler.com/check/apikeys\_api\_restricted\_with\_gemini\_api](https://hub.prowler.com/check/apikeys_api_restricted_with_gemini_api)
    
-   [https://cloud.google.com/service-usage/docs/enable-disable](https://cloud.google.com/service-usage/docs/enable-disable)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.