Description

Ensure that every Google Cloud API key is restricted to a specific, explicit list of Google APIs whenever the project has the Gemini API (Generative Language API, generativelanguage.googleapis.com) enabled. API keys without API restrictions can be used to call any enabled API in the project, including the Generative Language API, which grants access to Gemini model endpoints, uploaded files, and cached content. This control ensures API keys are scoped down to only the services an application actually needs.

Rationale

Google API keys are simple strings that do not identify the calling user or application, and they are commonly embedded in client-side code, mobile apps, and public repositories, since they were historically not treated as sensitive secrets. Once the Gemini API is enabled on a project, any unrestricted key in that project can be used to authenticate Gemini API requests, even if the key was originally created for an unrelated service such as Maps or Storage. A leaked, unrestricted key therefore exposes Gemini endpoints, uploaded files, and cached content to unauthorized use, and can additionally drive unexpected billing. Explicitly restricting each key to only the APIs it needs, and excluding the Generative Language API from keys that do not require it, significantly reduces the blast radius of a leaked key.

Impact

  • Prevents leaked or exposed API keys from being used to call the Gemini (Generative Language) API

  • Limits the blast radius of a compromised key to only its intended APIs

  • Reduces the risk of unauthorized access to uploaded files, cached content, and Gemini model usage

  • Helps prevent unexpected billing from unauthorized Generative Language API calls

  • Ensures compliance with major security frameworks (CIS, NIST, ISO, SOC2)

Default Value

By default, newly created Google Cloud API keys have no API restrictions configured and can call any API enabled in the project, including the Generative Language API once it is enabled. API restrictions must be configured manually for each key.

Pre-Requisites

  • A Google Cloud project with one or more API keys

  • IAM permissions to view and edit API keys (e.g., Service Usage Admin, Owner, or Editor role)

  • A documented list of the specific APIs each key is intended to call

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to APIs & Services > Credentials.

  4. Under APIs & Services > Enabled APIs & Services, confirm whether the Generative Language API (Gemini API) is enabled for the project.

  5. For each API key listed under Credentials, select the key to view its details.

  6. Under API restrictions, verify that Restrict key is selected rather than Don't restrict key.

  7. Verify the selected API list contains only the specific APIs the key is intended to call, and does not include the Generative Language API unless that access is explicitly required and documented.

  8. If any key is unrestricted, or is restricted but unintentionally includes the Generative Language API, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to APIs & Services > Credentials.

  4. Select the API key that needs to be restricted.

  5. Under API restrictions, select Restrict key.

  6. From the drop-down list, select only the specific APIs this key is required to call.

  7. Do not select the Generative Language API unless this key is specifically intended for Gemini API use, in which case it should be a dedicated key used only for that purpose.

  8. If Gemini API access is required, create a separate, dedicated key restricted only to the Generative Language API, and store it using an approved secrets management solution.

  9. Click Save to apply the restrictions.

  10. Repeat for every API key in the project.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to APIs & Services > Credentials.

  4. Select the API key whose restrictions need to be reverted.

  5. Under API restrictions, select Don't restrict key, or remove the specific APIs that were added.

  6. Click Save to apply the change.

Reference