Skip to main content

💼 1.14 Ensure API Keys Are Restricted to Only APIs That Application Needs Access - Level 2 (Automated)

  • Contextual name: 💼 1.14 Ensure API Keys Are Restricted to Only APIs That Application Needs Access - Level 2 (Automated)
  • ID: /frameworks/cis-gcp-v3.0.0/01/14
  • Located in: 💼 1 Identity and Access Management

Description​

API Keys should only be used for services in cases where other authentication methods are unavailable. API keys are always at risk because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API keys to use (call) only APIs required by an application.

Similar​

  • Internal
    • ID: dec-c-61b4f384

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags

Policies (1)​

PolicyLogic CountFlags
📝 Google API Key is not restricted for unused APIs 🟢1🟢 x6