Back to Checks
gcp

Project has no active API keys

apikeys_key_exists
Service: apikeysSeverity: medium
OfficialBuilt-inVerified
Categories:secrets
Resource Type:apikeys.googleapis.com/Key

Google Cloud projects are evaluated for active API keys. The finding indicates whether any keys exist and are enabled in the project, regardless of restrictions or usage.

Prowler logoProwlerprowler-provider-gcp

Risk

Active API keys are bearer tokens often exposed in clients and lack user identity. Compromise enables unauthorized API calls causing data exposure (C), unauthorized changes (I), quota/service exhaustion (A), and billing abuse. Keys can be harvested from code, logs, or intercepted requests.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks apikeys_key_exists

Recommendation

Prefer service accounts with short-lived credentials or OAuth 2.0, enforcing least privilege. If keys are necessary, restrict by API and application, store them in a secrets manager, rotate and revoke promptly, monitor with alerts as defense in depth, and remove unused keys.

Remediation

Other

1In the Google Cloud Console, go to APIs & Services > Credentials
2In the API keys section, for each key with state Active, click its row > Delete > Confirm
3Repeat until no API keys remain in the project
4Refresh the page to verify the API keys list is empty

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.apikeys.apikeys_client import apikeys_client


class apikeys_key_exists(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for project in apikeys_client.project_ids:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=apikeys_client.projects[project],
                project_id=project,
                location=apikeys_client.region,
            )
            report.status = "PASS"
            report.status_extended = f"Project {project} does not have active API Keys."
            for key in apikeys_client.keys:
                if key.project_id == project:
                    report.status = "FAIL"
                    report.status_extended = f"Project {project} has active API Keys."
                    break
            findings.append(report)

        return findings

References