GCP API Key Restriction Analysis
Use a connected service account to look up supported GCP API keys and inspect their API and caller restrictions.
Key Features
- Service account key JSON registration with project permission checks
- API Keys API lookup of a discovered API key
- Configured API targets and browser, server, Android or iOS caller restrictions
- Per-finding success and error states
Requirements
- 1A service account key JSON for a project where API Keys API lookup and get are permitted
- 2A Cremit account allowed to configure permission analysis
- 3A supported GCP API-key finding in a project the analyzer can access
Step-by-step setup guide
Review the steps needed to configure this integration.
Which key is analyzed?
This analyzer uses a service account as its connection credential. The object it analyzes is a discovered GCP API key. The worker calls the API Keys API to look up the key and read its configured API targets and caller restrictions, such as allowed referrers, IP addresses or app identifiers. It does not enumerate service-account IAM roles, inherited organization or folder bindings, or the effective permissions of a leaked service-account private key. A missing restriction is a configuration fact, not proof that an attacker used the key.
A key outside the connected project, missing API permissions, an invalid key or an API failure can leave the analysis incomplete or failed. Check each finding’s result and timestamp; do not interpret a connected analyzer as coverage of every GCP credential.
Register the connection
In Cremit Platform, open Security → Permission Analysis and add a GCP analyzer. The current form accepts a service-account key JSON. Before storing it, Cremit checks that it can obtain an access token and that the service account has apikeys.keys.lookup and apikeys.keys.get on the JSON key’s project. The form does not accept Workload Identity Federation configuration.
Grant only the permissions needed for the intended project and protect the private key as a credential. Google recommends avoiding user-managed service-account keys where a safer authentication method is available. If policy forbids creating such keys, this current analyzer connection may not be suitable; do not create an exception based on a claim of keyless federation support.
Read the result and respond
Open a supported GCP API-key finding after analysis and inspect the reported project, API targets and caller restrictions. Compare them with the intended workload and review actual use in the relevant Google Cloud logs. For a confirmed exposed key, the owner restricts, replaces or deletes it at the issuer and checks dependent applications. Removing the source text does not invalidate the key.
Primary documentation
Related reading
Other integrations in this category
Get started now
Review the setup steps and required permissions for the GCP API Key Restrictions integration.