Projects should not use API keys
Prowler evaluates each project for active `API keys`. It does this by determining whether any keys exist and are enabled in the project, so the evaluation looks at both the presence of keys and their enabled state within that project.
Active API keys are bearer tokens often exposed in clients and lack user identity. Compromise enables unauthorized API calls causing data exposure (C), unauthorized changes (I), quota/service exhaustion (A), and billing abuse.
What this control checks
Fails if the project has any API keys (gcp_apikeys_key count above 0); passes with none.
Common pitfalls
Finding reflects key existence and enabled state only
The finding indicates whether any keys exist and are enabled in the project, regardless of restrictions or usage.
Audit evidence
Evidence that deployed resources meet this control: Prowler check apikeys_key_exists (prowler gcp --checks apikeys_key_exists); PowerPipe control gcp_compliance.control.project_no_api_key.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 9.2.c (the relevant entities approach to key management, including, where appropriate, methods for the following:), 9.2.c.i (generating different keys for cryptographic systems and applications;), 9.2.c.ii (issuing and obtaining public key certificates;) and 1 more clause.
NIST SP 800-53 Rev 5: Mapped to PL-8 (Information Security Architecture) and SA-8 (Security Engineering Principles).
Framework mappings
The clauses this control is mapped to in each framework.
- 9 Cryptography
- PL-8 Information Security Architecture
- SA-8 Security Engineering Principles
- 1.12 Ensure API Keys Only Exist for Active Services
- 1.12 Ensure API Keys Only Exist for Active Services
- PSS-05.01B The cloud service provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility. These authentication mechanisms are set up at all access points that...
- 1.12 API Keys should only be used for services in cases where other authentication methods are unavailable. Unused keys with their permissions in tact may still exist within a project. Keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed...
NIST Cybersecurity Framework v1.0
- PR.IP-2: A System Development Life Cycle to manage systems is implemented.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
project_no_api_key - Powerpipe Control:
gcp_compliance.control.project_no_api_key - Prowler Check:
apikeys_key_exists
Last reviewed: 2026-10-09