Message reçu de Google Cloud – Demande d’explications

Bonjour,

J’ai reçu ce message hier et je n’ai aucune idée de quoi il s’agit. Comme il est
question de réglages de sécurité, j’aimerais comprendre pourquoi j’ai reçu ce
message de Google Cloud et savoir si je dois modifier quoi que ce soit dans mes
paramètres de sécurité.

Je n’ai d’ailleurs aucun souvenir de m’être inscrit à ce service (Google Cloud).

Voici le contenu du message reçu :

Objet : Security Best Practices for Managing Service Account and API Keys

We’re writing to provide you with security best practices regarding the
management of service account keys and API keys within your Google Cloud
environment.

Recent security trends indicate that long-lived credentials without proper
security best practices remain a top security risk for unauthorized access.
To ensure your environment remains secure, and to modernize your
authentication strategy, we strongly advise implementing the unified
security framework outlined below.

What you need to do

Action advised:

1. Secure the credential lifecycle

Apply standard security hygiene by following these best practices:

• Zero-Code Storage: Never commit keys to source code or version
  control. Use Secret Manager to inject credentials at runtime.
• Disable Dormant Keys: Audit your active keys and decommission
  any that show no activity over the last 30 days.
• Enforce API Restrictions: Never leave an API key unrestricted.
  Limit keys to specific APIs (e.g., Maps JavaScript only) and apply
  environmental restrictions (IP addresses, HTTP referrers, or bundle IDs).
• Apply Least Privilege: Never give full permissions to a
  service account. Use the IAM recommender to prune unused permissions,
  ensuring only the minimum access required.
• Mandatory Rotation: Implement the
  iam.serviceAccountKeyExpiryHours policy to enforce a maximum
  lifespan for all user-managed service account keys.
  If service account keys are not needed, implement
  iam.managed.disableServiceAccountKeyCreation to disable the
  creation of new service account keys.

2. Improve operational safeguards

Ensure rapid response to security incidents by completing the following:

• Set Essential Contacts: Verify that your Essential Contactsare up to date so critical security notifications reach the right people.
• Set Billing Anomaly and Budget Alerts: Ensure billing anomalyand budget alert notifications are monitored and acted upon. A sudden spikein usage is often the first indicator of a compromised credential.

We’re here to help.

We are committed to helping you maintain a secure environment. If you have
any questions or require assistance, please contact Google Cloud Support.

Thanks for choosing Google Cloud.