API Keys

Abusable GCP API Keys that can lead to compromise or privilege escalation

Overview

• API keys can be created in a project with no API restrictions and no application restrictions which means leaked keys or an attacker creating a key introduces a risk.

• Not all services e.g., IAM, Secret Manager, or BigQuery support API key-based auth.

---

serviceusage.apiKeys.create

• With this permission, an attacker can create a new API key in the project with no API restrictions and no application restrictions.

gcloud services api-keys create --display-name="<NAME>" --project=<PROJECT>

---

apikeys.keys.getKeyString

• With this permission, an attacker can retrieve the API key value

• Note — you need the key's name not its displayName

## Return key name
gcloud services api-keys list

## Return API key credential
gcloud services api-keys get-key-string projects/<Project-Id>/locations/global/keys/<KEY-NAME>

---