IAM users should not hold both KMS admin and KMS key user roles
Recommends that the principle of 'Separation of Duties' is enforced when assigning `KMS` related roles to users. The recommendation concerns how `KMS` related roles are assigned to individual users, so that the principle is applied to those assignments.
What this control checks
Checks that KMS separation of duty is enforced for IAM users
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.iam_user_kms_separation_of_duty_enforced.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to GV.SC-06 (Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party...), PR.AA-01 (Identities and credentials for authorized users, services, and hardware are managed by the organization.), PR.AA-02 (Identities are proofed and bound to credentials based on the context of interactions.) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions.
- PR.AA-05
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_user_kms_separation_of_duty_enforced - Powerpipe Control:
gcp_compliance.control.iam_user_kms_separation_of_duty_enforced
Last reviewed: 2026-10-09