---
title: Cloud KMS cryptokeys should restrict anonymous and/or public access
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Cloud KMS cryptokeys should restrict
  anonymous and/or public access
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Cloud KMS cryptokeys should restrict anonymous and/or public access
 
## Description{% #description %}

This rule fails when the IAM policy on a Cloud KMS crypto key grants a role to `allUsers` or `allAuthenticatedUsers`. Public access lets anyone on the internet, or anyone with a Google account, use or manage the key according to the granted role. A public binding to the Cloud KMS CryptoKey Public Key Viewer role (`roles/cloudkms.publicKeyViewer`) passes, because it only exposes the public half of an asymmetric key and grants no encrypt, decrypt, or key management access. This differs from the CIS audit, which flags any public principal. IAM policies attached to other resources are skipped, and a policy with no resource name fails because it cannot be classified.

## Remediation{% #remediation %}

1. Remove the `allUsers` and `allAuthenticatedUsers` bindings from the key's IAM policy by following [Access control with IAM](https://docs.cloud.google.com/kms/docs/iam).
1. Grant the roles that are still needed to specific users, groups, or service accounts.

## References{% #references %}

- [Retrieve a public key](https://docs.cloud.google.com/kms/docs/retrieve-public-key)
- [CIS Google Cloud Platform Foundation Benchmark](https://www.cisecurity.org/benchmark/google_cloud_computing_platform)