Back to Checks
gcp

API key is restricted to specific Google APIs

apikeys_api_restrictions_configured
Service: apikeysSeverity: high
OfficialBuilt-inVerified
Categories:secretsidentity-access
Resource Type:apikeys.googleapis.com/Key

Google Cloud API keys have API restrictions limiting calls to specific services. The finding checks that keys are restricted to named Google APIs and do not include the broad cloudapis.googleapis.com, indicating keys are scoped only to intended use.

Prowler logoProwlerprowler-provider-gcp

Risk

Unrestricted keys-or ones allowing cloudapis.googleapis.com-expand attack surface. A leaked key can call many APIs without identity, enabling data exposure, unintended changes on permissive endpoints, and quota/billing exhaustion, impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks apikeys_api_restrictions_configured

Recommendation

Apply least privilege: restrict each API key to only the specific APIs it must access and never include cloudapis.googleapis.com. Add application restrictions (referrers, IPs, app IDs), rotate keys, and monitor usage. Prefer service accounts or short-lived tokens for production as part of defense in depth.

Remediation

CLI

gcloud services api-keys update <KEY_ID> --api-target=service=<SERVICE_NAME>

Terraform

resource "google_apikeys_key" "key" {
  display_name = "<example_resource_name>"

  restrictions {
    api_targets {
      service = "<SERVICE_NAME>" # Critical: restricts the key to a specific API, removing any "All Google APIs" (cloudapis.googleapis.com)
    }
  }
}

Other

1In Google Cloud Console, go to APIs & Services > Credentials
2Click the API key name to edit it
3In API restrictions, select "Restrict key"
4Choose only the specific API(s) needed (do not select "All Google APIs")
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.apikeys.apikeys_client import apikeys_client


class apikeys_api_restrictions_configured(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for key in apikeys_client.keys:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=key,
                location=apikeys_client.region,
            )
            report.status = "PASS"
            report.status_extended = f"API key {key.name} has restrictions configured."
            if key.restrictions == {} or any(
                [
                    target.get("service") == "cloudapis.googleapis.com"
                    for target in key.restrictions.get("apiTargets", [])
                ]
            ):
                report.status = "FAIL"
                report.status_extended = (
                    f"API key {key.name} does not have restrictions configured."
                )
            findings.append(report)

        return findings

References