Back to Checks
gcp

Gemini (Generative Language) API is disabled

gemini_api_disabled
Service: geminiSeverity: medium
OfficialBuilt-inVerified
Categories:gen-aiidentity-access
Resource Type:serviceusage.googleapis.com/Service

The Gemini API (a.k.a. Generative Language API, generativelanguage.googleapis.com) should not be used. It does not adhere to GCP's general security & compliance standards.

Prowler logoProwlerprowler-provider-gcp

Risk

The API does not support GCP IAM for authentication, impacting confidentiality of uploaded files and cached content. It provides no SLA, reducing availability guarantees. It is not covered by compliance certifications such as ISO 27001, SOC 2, C5, and HIPAA, which can diminish your compliance posture.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks gemini_api_disabled

Recommendation

Do not use the Gemini API. Instead, consider using Gemini through the Vertex AI API, which does not have the described issues.

Remediation

CLI

gcloud services disable generativelanguage.googleapis.com

Other

1In Google Cloud Console, go to "APIs & Services" > "Enabled APIs & services"
2Click "Generative Language API" to view service details.
3Click "Disable API" in the top bar and confirm the action.

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.lib.constants import GEMINI_SERVICE_NAME
from prowler.providers.gcp.services.serviceusage.serviceusage_client import (
    serviceusage_client,
)


class gemini_api_disabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []

        for project_id in serviceusage_client.project_ids:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=serviceusage_client.projects[project_id],
                resource_id=GEMINI_SERVICE_NAME,
                resource_name="Gemini (Generative Language) API",
                project_id=project_id,
                location=serviceusage_client.region,
            )
            report.status = "FAIL"
            report.status_extended = (
                f"Gemini (Generative Language) API is enabled for project {project_id}"
            )

            genlang_enabled = any(
                active_service.name == GEMINI_SERVICE_NAME
                for active_service in serviceusage_client.active_services.get(
                    project_id, []
                )
            )

            if not genlang_enabled:
                report.status = "PASS"
                report.status_extended = f"Gemini (Generative Language) API is disabled for project {project_id}"

            findings.append(report)

        return findings

References