GCP Cloud KMS Key Rings are anonymously or publicly accessible misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_GCP_8
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	GCP
Severity	HIGH
Framework	Terraform

Impact

Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible

How to Fix

Resource: google_kms_key_ring_iam_member

• Field: member
• Resource: google_kms_key_ring_iam_binding
• Field: members [source,go]

---

{ " //Option 1 resource "google_kms_key_ring_iam_member" "member" { key_ring_id = google_kms_key_ring.default.id role = "roles/cloudkms.cryptoKeyEncrypter"

• member = "allUsers"
• member = "allAuthenticatedUsers" }

//Option 2 resource "google_kms_key_ring_iam_binding" "binding" { key_ring_id = google_kms_key_ring.default.id role = "roles/cloudkms.cryptoKeyEncrypter" members = [

• "allUsers",
• "allAuthenticatedUsers" ] }

", }