---
title: KMS roles assigned to users should utilize 'Separation of Duties'
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > KMS roles assigned to users should
  utilize 'Separation of Duties'
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# KMS roles assigned to users should utilize 'Separation of Duties'
 
## Description{% #description %}

This rule fails when one user (a `user:` member, matched without regard to case) in an IAM policy holds the Cloud KMS Admin role (`roles/cloudkms.admin`) and also a Cloud KMS CryptoKey Encrypter, Decrypter, or Encrypter/Decrypter role. Separating key administration from key use prevents one person from both managing a key and using it to decrypt the data it protects. The check passes when these roles are held by different users, and it does not evaluate service accounts or groups. The check evaluates each IAM policy on its own. Roles granted on a different resource, inherited from a folder or organization, or held through a group are not combined.

## Remediation{% #remediation %}

1. Remove either the Cloud KMS Admin role or the encrypt and decrypt roles from the flagged user, following [Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access#revoke-access) for those policies or [Access control with IAM](https://docs.cloud.google.com/kms/docs/iam) for key and key-ring policies.
1. Grant the removed role to a different user or service account if it is still needed.

## References{% #references %}

- [Separation of duties](https://docs.cloud.google.com/kms/docs/separation-of-duties)
- [Access control with IAM](https://docs.cloud.google.com/kms/docs/iam)
- [CIS Google Cloud Platform Foundation Benchmark](https://www.cisecurity.org/benchmark/google_cloud_computing_platform)