Back to Checks
gcp

API key was created within the last 90 days

apikeys_key_rotated_in_90_days
Service: apikeysSeverity: medium
OfficialBuilt-inVerified
Categories:secrets
Resource Type:apikeys.googleapis.com/Key

Google Cloud API keys are evaluated for rotation age using their creation_time. Keys created within the last 90 days are treated as recently rotated; keys older than 90 days are treated as overdue.

Prowler logoProwlerprowler-provider-gcp

Risk

Stale, long-lived API keys are bearer tokens without IAM context. If exposed, attackers can invoke allowed APIs, enabling data exfiltration (confidentiality), unauthorized changes (integrity), and quota/billing abuse or disruption (availability). Lack of rotation prolongs misuse.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks apikeys_key_rotated_in_90_days

Recommendation

Rotate API keys at least every 90 days. Prefer service accounts or OAuth with short-lived credentials. Enforce API and application/IP restrictions. Store keys in a secrets manager, avoid client-side embedding, and monitor usage. Apply least privilege and defense in depth.

Remediation

Other

1In the Google Cloud Console, go to APIs & Services > Credentials
2Under API keys, click the key older than 90 days
3Click Rotate key, then click Create to generate the new key
4Copy the new key string and update your applications to use it
5In the Previous key section, click Delete the previous key
6Repeat for any remaining API keys older than 90 days until only keys created within 90 days remain

Check Code

from datetime import datetime, timezone

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.apikeys.apikeys_client import apikeys_client


class apikeys_key_rotated_in_90_days(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for key in apikeys_client.keys:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=key,
                location=apikeys_client.region,
            )
            report.status = "PASS"
            report.status_extended = f"API key {key.name} created in less than 90 days."
            if (
                datetime.now(timezone.utc)
                - datetime.strptime(key.creation_time, "%Y-%m-%dT%H:%M:%S.%f%z")
            ).days > 90:
                report.status = "FAIL"
                report.status_extended = (
                    f"API key {key.name} creation date has more than 90 days."
                )
            findings.append(report)

        return findings

References