Cloud Key Management Service (KMS)

methodName	Description	Log type	Sample	Rule
any	Catch-all entry for cloudkms.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.	activity	N	Y
AsymmetricDecrypt		data_access	N	N
AsymmetricSign		data_access	N	N
CreateCryptoKey	Creates a new CryptoKey within a KeyRing.	activity	Y	N
CreateCryptoKeyVersion	Creates a new CryptoKeyVersion in a CryptoKey.	activity	N	N
CreateImportJob		activity	Y	N
CreateKeyRing	Creates a new KeyRing in a given Project and Location.	activity	Y	N
Decapsulate		data_access	N	N
Decrypt	Decrypts data that was protected by Encrypt. The CryptoKey.purpose must be ENCRYPT_DECRYPT.	data_access	Y	Y
DeleteCryptoKey		activity	N	N
DeleteCryptoKeyVersion	Schedules a CryptoKeyVersion for destruction. A CryptoKey may not be deleted, but this method will schedule the given CryptoKeyVersion for destruction.	activity	N	N
DestroyCryptoKeyVersion	Schedule a CryptoKeyVersion for destruction. After calling this method, CryptoKeyVersion.state will be set to DESTROY_SCHEDULED, and the key material will be irreversibly destroyed after 24 hours.	activity	Y	Y
Encrypt	Encrypts data, so that it can only be recovered by a call to Decrypt. The CryptoKey.purpose must be ENCRYPT_DECRYPT.	data_access	Y	Y
GenerateRandomBytes	Not audit-logged: Google excludes this method from Cloud Audit Logs as a high-volume data-plane operation, so no audit log entry ever records it. Detections cannot source this operation from Cloud Audit Logs.	not_audited	N	N
GetCryptoKey		data_access	N	N
GetCryptoKeyVersion		data_access	N	N
GetImportJob		data_access	N	N
GetKeyRing		data_access	N	N
GetPublicKey		data_access	N	N
GetRetiredResource		data_access	N	N
ImportCryptoKeyVersion	Imports a new CryptoKeyVersion into an existing CryptoKey using the wrapped key material provided in the request.	activity	N	N
ListCryptoKeyVersions		data_access	Y	N
ListCryptoKeys		data_access	Y	N
ListImportJobs		data_access	N	N
ListKeyRings		data_access	Y	N
ListRetiredResources		data_access	N	N
MacSign		data_access	N	N
MacVerify		data_access	N	N
RawDecrypt		data_access	N	N
RawEncrypt		data_access	N	N
RestoreCryptoKeyVersion	Restores a CryptoKeyVersion in the DESTROY_SCHEDULED state.	activity	N	N
UpdateCryptoKey	Update a CryptoKey.	activity	N	N
UpdateCryptoKeyPrimaryVersion	Update the version of a CryptoKey that will be used in Encrypt.	activity	N	N
UpdateCryptoKeyVersion	Update a CryptoKeyVersion's metadata. Its state may be changed between ENABLED and DISABLED using this method.	activity	Y	Y
ExportTrustedKeyWrappedCryptoKeyVersion		activity	N	N
ImportTrustedKeyWrappedCryptoKeyVersion		activity	N	N

any: cloudkms.googleapis.com (any method)

ServiceName: cloudkms.googleapis.com

Description

Catch-all entry for cloudkms.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GCP KMS Key Granted to GCS Service Account source medium: Detects when a KMS IAM policy grants encryption/decryption permissions to a GCS service account. This pattern may indicate a ransomware attack where an adversary grants a GCS service account access to KMS keys to enable encryption of cloud storage objects.T1486, T1562

AsymmetricDecrypt

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

AsymmetricSign

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

CreateCryptoKey: Create crypto key

ServiceName: cloudkms.googleapis.com

Description

Creates a new CryptoKey within a KeyRing.

Example Audit Log Entry #

{
  "insertId": "cjar5fdiaut",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudkms.cryptoKeys.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065/cryptoKeys/dwgen-dw739065",
          "service": "google.cloud.kms",
          "type": "cloudkms.googleapis.com/CryptoKey"
        }
      }
    ],
    "metadata": {},
    "methodName": "CreateCryptoKey",
    "request": {
      "@type": "type.googleapis.com/google.cloud.kms.v1.CreateCryptoKeyRequest",
      "cryptoKey": {
        "purpose": "ENCRYPT_DECRYPT",
        "versionTemplate": {
          "algorithm": "GOOGLE_SYMMETRIC_ENCRYPTION",
          "protectionLevel": "SOFTWARE"
        }
      },
      "cryptoKeyId": "dwgen-dw739065",
      "parent": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.kms.keys.create invocation-id/f3f425ce0dbd4b919845f705b34b12a2 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:47.484189050Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065/cryptoKeys/dwgen-dw739065",
    "serviceName": "cloudkms.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:19:47.792739134Z",
  "resource": {
    "labels": {
      "crypto_key_id": "dwgen-dw739065",
      "key_ring_id": "dwgen-dw739065",
      "location": "us-central1",
      "project_id": "example-project-id"
    },
    "type": "cloudkms_cryptokey"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T13:19:47.468314317Z"
}

CreateCryptoKeyVersion: Create crypto key version

ServiceName: cloudkms.googleapis.com

Description

Creates a new CryptoKeyVersion in a CryptoKey.

CreateImportJob

ServiceName: cloudkms.googleapis.com

Example Audit Log Entry #

{
  "insertId": "1os3tcle1vor7",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudkms.importJobs.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/us-central1/keyRings/dwkr3-dw745304",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/us-central1/keyRings/dwkr3-dw745304/importJobs/dwij-dw745304",
          "service": "google.cloud.kms",
          "type": "cloudkms.googleapis.com/ImportJob"
        }
      }
    ],
    "metadata": {},
    "methodName": "CreateImportJob",
    "request": {
      "@type": "type.googleapis.com/google.cloud.kms.v1.CreateImportJobRequest",
      "importJob": {
        "importMethod": "RSA_OAEP_3072_SHA1_AES_256",
        "protectionLevel": "SOFTWARE"
      },
      "importJobId": "dwij-dw745304",
      "parent": "projects/example-project-id/locations/us-central1/keyRings/dwkr3-dw745304"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.kms.import-jobs.create invocation-id/41c31ead34e84cdbba1ff367ac4fd475 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:05:35.573457172Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "projects/example-project-id/locations/us-central1/keyRings/dwkr3-dw745304/importJobs/dwij-dw745304",
    "serviceName": "cloudkms.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:05:36.382165578Z",
  "resource": {
    "labels": {
      "method": "CreateImportJob",
      "project_id": "example-project-id",
      "service": "cloudkms.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T15:05:35.563076750Z"
}

CreateKeyRing: Create key ring

ServiceName: cloudkms.googleapis.com

Description

Creates a new KeyRing in a given Project and Location.

Example Audit Log Entry #

{
  "insertId": "19j8goqdbitd",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudkms.keyRings.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/us-central1",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065",
          "service": "google.cloud.kms",
          "type": "cloudkms.googleapis.com/KeyRing"
        }
      }
    ],
    "metadata": {},
    "methodName": "CreateKeyRing",
    "request": {
      "@type": "type.googleapis.com/google.cloud.kms.v1.CreateKeyRingRequest",
      "keyRingId": "dwgen-dw739065",
      "parent": "projects/example-project-id/locations/us-central1"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.kms.keyrings.create invocation-id/1958afdc86d041209b9a85d6edef6ee3 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:46.339881407Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065",
    "serviceName": "cloudkms.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:19:46.849803097Z",
  "resource": {
    "labels": {
      "key_ring_id": "dwgen-dw739065",
      "location": "us-central1",
      "project_id": "example-project-id"
    },
    "type": "cloudkms_keyring"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T13:19:46.322841771Z"
}

Decapsulate

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

Decrypt

ServiceName: cloudkms.googleapis.com

Description

Decrypts data that was protected by Encrypt. The CryptoKey.purpose must be ENCRYPT_DECRYPT.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "ofx330e5irn1",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudkms.cryptoKeyVersions.useToDecrypt",
        "permissionType": "DATA_READ",
        "resource": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065/cryptoKeys/dwgen-dw739065",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065/cryptoKeys/dwgen-dw739065",
          "service": "google.cloud.kms",
          "type": "cloudkms.googleapis.com/CryptoKey"
        }
      }
    ],
    "metadata": {},
    "methodName": "Decrypt",
    "request": {
      "@type": "type.googleapis.com/google.cloud.kms.v1.DecryptRequest",
      "name": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065/cryptoKeys/dwgen-dw739065"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.kms.decrypt invocation-id/167a5ad4bd1844babe704a196b43d7ec environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:49.746421751Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065/cryptoKeys/dwgen-dw739065",
    "serviceName": "cloudkms.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:19:50.778425989Z",
  "resource": {
    "labels": {
      "crypto_key_id": "dwgen-dw739065",
      "key_ring_id": "dwgen-dw739065",
      "location": "us-central1",
      "project_id": "example-project-id"
    },
    "type": "cloudkms_cryptokey"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:19:49.698293732Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

Unauthorized KMS Decryption source: Detects when a Key Management Service (KMS) decryption operation is carried out by a service account that's not in the allowlist. This behavior may indicate unauthorized access to information.

DeleteCryptoKey

ServiceName: cloudkms.googleapis.com

DeleteCryptoKeyVersion: Delete crypto key version

ServiceName: cloudkms.googleapis.com

Description

Schedules a CryptoKeyVersion for destruction. A CryptoKey may not be deleted, but this method will schedule the given CryptoKeyVersion for destruction.

DestroyCryptoKeyVersion: Destroy crypto key version

ServiceName: cloudkms.googleapis.com

Description

Schedule a CryptoKeyVersion for destruction. After calling this method, CryptoKeyVersion.state will be set to DESTROY_SCHEDULED, and the key material will be irreversibly destroyed after 24 hours.

Example Audit Log Entry #

{
  "insertId": "19j8goqdfpma",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudkms.cryptoKeyVersions.destroy",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/us-central1/keyRings/dwkr7201353/cryptoKeys/dwk7201353/cryptoKeyVersions/1",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/us-central1/keyRings/dwkr7201353/cryptoKeys/dwk7201353/cryptoKeyVersions/1",
          "service": "google.cloud.kms",
          "type": "cloudkms.googleapis.com/CryptoKeyVersion"
        }
      }
    ],
    "metadata": {},
    "methodName": "DestroyCryptoKeyVersion",
    "request": {
      "@type": "type.googleapis.com/google.cloud.kms.v1.DestroyCryptoKeyVersionRequest",
      "name": "projects/example-project-id/locations/us-central1/keyRings/dwkr7201353/cryptoKeys/dwk7201353/cryptoKeyVersions/1"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.kms.keys.versions.destroy invocation-id/39aff982457446e9a9b37af2e3892337 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:21:46.935216361Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "projects/example-project-id/locations/us-central1/keyRings/dwkr7201353/cryptoKeys/dwk7201353/cryptoKeyVersions/1",
    "serviceName": "cloudkms.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:21:47.351361712Z",
  "resource": {
    "labels": {
      "crypto_key_id": "dwk7201353",
      "crypto_key_version_id": "1",
      "key_ring_id": "dwkr7201353",
      "location": "us-central1",
      "project_id": "example-project-id"
    },
    "type": "cloudkms_cryptokeyversion"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:21:46.921720858Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

GCP Multiple KMS Keys Disabled Or Destroyed source high: Detect when multiple KMS crypto key versions are disabled or destroyed from GCP Cloud KMS.T1485↳ also matches UpdateCryptoKeyVersion: Update crypto key version

Panther #

GCP KMS Key Version Disabled or Destroyed source informational: Detects when a KMS key version is disabled, scheduled for destruction, or destroyed. Disabling or destroying KMS key versions can be used to deny access to encrypted data—a ransomware tactic where attackers disable keys to prevent victims from accessing their data.T1486, T1562↳ also matches UpdateCryptoKeyVersion: Update crypto key version

Encrypt

ServiceName: cloudkms.googleapis.com

Description

Encrypts data, so that it can only be recovered by a call to Decrypt. The CryptoKey.purpose must be ENCRYPT_DECRYPT.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "1c065uxeg1zj8",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudkms.cryptoKeyVersions.useToEncrypt",
        "permissionType": "DATA_READ",
        "resource": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065/cryptoKeys/dwgen-dw739065",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065/cryptoKeys/dwgen-dw739065",
          "service": "google.cloud.kms",
          "type": "cloudkms.googleapis.com/CryptoKey"
        }
      }
    ],
    "metadata": {},
    "methodName": "Encrypt",
    "request": {
      "@type": "type.googleapis.com/google.cloud.kms.v1.EncryptRequest",
      "name": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065/cryptoKeys/dwgen-dw739065"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.kms.encrypt invocation-id/988e3394e0c34c07a86c93808cd213d5 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:48.637092708Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065/cryptoKeys/dwgen-dw739065",
    "serviceName": "cloudkms.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:19:49.612727479Z",
  "resource": {
    "labels": {
      "crypto_key_id": "dwgen-dw739065",
      "key_ring_id": "dwgen-dw739065",
      "location": "us-central1",
      "project_id": "example-project-id"
    },
    "type": "cloudkms_cryptokey"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:19:48.608500631Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`protoPayload.authenticationInfo.principalEmail` (panther rule field)	contains	`gs-project-accounts.iam.gserviceaccount.com`	2 rules	panther
`severity` (panther rule field)	ne	`ERROR`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GCP KMS Bulk Encryption by GCS Service Account source medium: Detects bulk KMS encryption operations performed by the GCS service account. This pattern is indicative of a ransomware attack where an adversary directly calls the KMS Encrypt API using the GCS service account identity to encrypt data at scale, effectively holding data hostage. The threshold of 10+ encryption operations suggests automated bulk encryption rather than normal application behavior.T1486
GCP KMS Cross-Project Encryption source high: Detects when a GCS service account in one project uses a KMS encryption key from a different project. This could indicate potential ransomware activity where an attacker is using their own KMS key to encrypt data in a victim's project, making it inaccessible without the attacker's key.

GenerateRandomBytes

ServiceName: cloudkms.googleapis.com

Description

Not audit-logged: Google excludes this method from Cloud Audit Logs as a high-volume data-plane operation, so no audit log entry ever records it. Detections cannot source this operation from Cloud Audit Logs.

GetCryptoKey

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

GetCryptoKeyVersion

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

GetImportJob

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

GetKeyRing

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

GetPublicKey

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

GetRetiredResource

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

ImportCryptoKeyVersion: Import crypto key version

ServiceName: cloudkms.googleapis.com

Description

Imports a new CryptoKeyVersion into an existing CryptoKey using the wrapped key material provided in the request.

ListCryptoKeyVersions

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "1os3tcle1p41s",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudkms.cryptoKeyVersions.list",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065/cryptoKeys/dwgen-dw739065",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065/cryptoKeys/dwgen-dw739065",
          "service": "google.cloud.kms",
          "type": "cloudkms.googleapis.com/CryptoKey"
        }
      }
    ],
    "metadata": {},
    "methodName": "ListCryptoKeyVersions",
    "numResponseItems": "1",
    "request": {
      "@type": "type.googleapis.com/google.cloud.kms.v1.ListCryptoKeyVersionsRequest",
      "pageSize": 100,
      "parent": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065/cryptoKeys/dwgen-dw739065"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.kms.keys.versions.list invocation-id/c490d7d584304b908d157ddaf5140cdc environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:50.882018947Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "projects/example-project-id/locations/us-central1/keyRings/dwgen-dw739065/cryptoKeys/dwgen-dw739065",
    "serviceName": "cloudkms.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:19:51.672667408Z",
  "resource": {
    "labels": {
      "crypto_key_id": "dwgen-dw739065",
      "crypto_key_version_id": "",
      "key_ring_id": "dwgen-dw739065",
      "location": "us-central1",
      "project_id": "example-project-id"
    },
    "type": "cloudkms_cryptokeyversion"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:19:50.873457328Z"
}

ListCryptoKeys

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "15wkxyye281lb",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "000000000000.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudkms.cryptoKeys.list",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id/locations/global/keyRings/dw-harn-8be285",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/global/keyRings/dw-harn-8be285",
          "service": "google.cloud.kms",
          "type": "cloudkms.googleapis.com/KeyRing"
        }
      }
    ],
    "metadata": {},
    "methodName": "ListCryptoKeys",
    "numResponseItems": "1",
    "request": {
      "@type": "type.googleapis.com/google.cloud.kms.v1.ListCryptoKeysRequest",
      "pageSize": 100,
      "parent": "projects/example-project-id/locations/global/keyRings/dw-harn-8be285"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.kms.keys.list invocation-id/53a7631619794f43b36987355b073ca7 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-07-02T02:37:27.876526938Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "global"
      ]
    },
    "resourceName": "projects/example-project-id/locations/global/keyRings/dw-harn-8be285",
    "serviceName": "cloudkms.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-07-02T02:37:28.938768964Z",
  "resource": {
    "labels": {
      "crypto_key_id": "",
      "key_ring_id": "dw-harn-8be285",
      "location": "global",
      "project_id": "example-project-id"
    },
    "type": "cloudkms_cryptokey"
  },
  "severity": "INFO",
  "timestamp": "2026-07-02T02:37:27.865816956Z"
}

ListImportJobs

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

ListKeyRings

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "1os3tcle1oz29",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudkms.keyRings.list",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id/locations/us-central1",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/us-central1",
          "service": "google.cloud.kms",
          "type": "cloud.googleapis.com/Location"
        }
      }
    ],
    "metadata": {},
    "methodName": "ListKeyRings",
    "request": {
      "@type": "type.googleapis.com/google.cloud.kms.v1.ListKeyRingsRequest",
      "pageSize": 100,
      "parent": "projects/example-project-id/locations/us-central1"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.kms.keyrings.list invocation-id/b4fcec43c2f545c5a8afc48af3ad2b81 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:17:54.583097430Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "projects/example-project-id/locations/us-central1",
    "serviceName": "cloudkms.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:17:55.295080484Z",
  "resource": {
    "labels": {
      "key_ring_id": "",
      "location": "us-central1",
      "project_id": "example-project-id"
    },
    "type": "cloudkms_keyring"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:17:54.560951756Z"
}

ListRetiredResources

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

MacSign

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

MacVerify

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

RawDecrypt

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

RawEncrypt

ServiceName: cloudkms.googleapis.com

Data Access audit logs are disabled by default.

RestoreCryptoKeyVersion: Restore crypto key version

ServiceName: cloudkms.googleapis.com

Description

Restores a CryptoKeyVersion in the DESTROY_SCHEDULED state.

UpdateCryptoKey: Update crypto key

ServiceName: cloudkms.googleapis.com

Description

Update a CryptoKey.

UpdateCryptoKeyPrimaryVersion: Update crypto key primary version

ServiceName: cloudkms.googleapis.com

Description

Update the version of a CryptoKey that will be used in Encrypt.

UpdateCryptoKeyVersion: Update crypto key version

ServiceName: cloudkms.googleapis.com

Description

Update a CryptoKeyVersion's metadata. Its state may be changed between ENABLED and DISABLED using this method.

Example Audit Log Entry #

{
  "insertId": "116oyh0duh0f",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudkms.cryptoKeyVersions.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/us-central1/keyRings/dwkr7201353/cryptoKeys/dwk7201353/cryptoKeyVersions/1",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/us-central1/keyRings/dwkr7201353/cryptoKeys/dwk7201353/cryptoKeyVersions/1",
          "service": "google.cloud.kms",
          "type": "cloudkms.googleapis.com/CryptoKeyVersion"
        }
      },
      {
        "granted": true,
        "permission": "cloudkms.cryptoKeyVersions.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/us-central1/keyRings/dwkr7201353/cryptoKeys/dwk7201353/cryptoKeyVersions/1",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/us-central1/keyRings/dwkr7201353/cryptoKeys/dwk7201353/cryptoKeyVersions/1",
          "service": "google.cloud.kms",
          "type": "cloudkms.googleapis.com/CryptoKeyVersion"
        }
      }
    ],
    "metadata": {},
    "methodName": "UpdateCryptoKeyVersion",
    "request": {
      "@type": "type.googleapis.com/google.cloud.kms.v1.UpdateCryptoKeyVersionRequest",
      "cryptoKeyVersion": {
        "name": "projects/example-project-id/locations/us-central1/keyRings/dwkr7201353/cryptoKeys/dwk7201353/cryptoKeyVersions/1",
        "state": "DISABLED"
      },
      "updateMask": "state"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.kms.keys.versions.disable invocation-id/587e3d4a35d44e80a10e61b2ad4f25ee environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:21:45.775198227Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "projects/example-project-id/locations/us-central1/keyRings/dwkr7201353/cryptoKeys/dwk7201353/cryptoKeyVersions/1",
    "serviceName": "cloudkms.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:21:46.045664030Z",
  "resource": {
    "labels": {
      "crypto_key_id": "dwk7201353",
      "crypto_key_version_id": "1",
      "key_ring_id": "dwkr7201353",
      "location": "us-central1",
      "project_id": "example-project-id"
    },
    "type": "cloudkms_cryptokeyversion"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:21:45.760065795Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

GCP Multiple KMS Keys Disabled Or Destroyed source high: Detect when multiple KMS crypto key versions are disabled or destroyed from GCP Cloud KMS.T1485↳ also matches DestroyCryptoKeyVersion: Destroy crypto key version

Panther #

GCP KMS Key Version Disabled or Destroyed source informational: Detects when a KMS key version is disabled, scheduled for destruction, or destroyed. Disabling or destroying KMS key versions can be used to deny access to encrypted data—a ransomware tactic where attackers disable keys to prevent victims from accessing their data.T1486, T1562↳ also matches DestroyCryptoKeyVersion: Destroy crypto key version

ExportTrustedKeyWrappedCryptoKeyVersion

ServiceName: cloudkms.googleapis.com

ImportTrustedKeyWrappedCryptoKeyVersion

ServiceName: cloudkms.googleapis.com