Cloud KMS encryption keys should limit users to 3
Checks that each Cloud KMS encryption key has three or fewer users. Keys with more than three users fail the check, and the recommendation is to limit the users of each KMS encryption key to three at most.
What this control checks
Cloud KMS encryption keys should limit users to 3
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.kms_key_users_limited_to_3.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to GV.SC-10 (Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a...), PR.AA-01 (Identities and credentials for authorized users, services, and hardware are managed by the organization.), PR.AA-04 (Identity assertions are protected, conveyed, and verified.) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-04
- PR.DS-01
- 3.5.2 Restrict access to cryptographic keys to the fewest number of custodians necessary
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kms_key_users_limited_to_3 - Powerpipe Control:
gcp_compliance.control.kms_key_users_limited_to_3
Last reviewed: 2026-10-09