Google Cloud API Keys Retain Access Post-Deletion to Gemini, BigQuery, Maps

Key Takeaways

• Google Cloud API keys can remain functional for up to 23 minutes after being “deleted,” creating a significant security window for potential abuse.
• This delayed revocation affects critical services like Gemini, BigQuery, and Google Maps APIs, allowing continued access to sensitive data and functionalities.
• Google acknowledges this as “expected behavior” due to eventual consistency in its distributed systems and has no plans to implement an immediate fix.
• Organizations must adjust incident response protocols, treating API key deletion as a prolonged process rather than an instantaneous one.

Google Cloud API Keys Retain Access Post-Deletion

A recent disclosure reveals a critical vulnerability in Google Cloud’s API key management, where “deleted” API keys can continue to grant access to sensitive services for an extended period. This issue, uncovered by Aikido research, highlights a significant delay in credential invalidation across Google’s infrastructure, potentially exposing projects to unauthorized access long after revocation has been initiated.

The core problem stems from the asynchronous propagation of revocation signals across Google’s vast distributed systems. Instead of immediate invalidation, a “revocation window” is created during which a deleted key can still successfully authenticate requests. Researchers observed this window lasting up to approximately 23 minutes, with a median duration of around 16 minutes, and the shortest observed period being about 8 minutes.

During this period, if an API key has been compromised and subsequently “deleted” by an administrator, an attacker in possession of that leaked key can continue to make legitimate API calls. This is because some backend servers may not yet have received the revocation signal, leading to inconsistent enforcement of access policies.

Impact on High-Value Services

The implications of this delay become particularly severe when high-value Google Cloud services are involved. For instance, if a compromised key provides access to the Google Gemini API, attackers could:

• Retrieve previously uploaded files.
• Access cached conversational data.
• Continue to interact with AI endpoints, potentially incurring costs or exfiltrating information.

Similar persistent access was observed across other integral services, including the BigQuery and Google Maps APIs. This widespread behavior suggests the delay is inherent to Google’s core API key infrastructure rather than an isolated issue with specific services.

Research Methodology and Findings

Aikido researchers conducted controlled experiments over several days to quantify this delay. They repeatedly created and deleted API keys, then immediately began sending 3 to 5 authenticated requests per second to various Google Cloud services. The duration for which these requests continued to succeed post-deletion was meticulously measured.

The results indicated an unpredictable success rate. For example, one minute after deletion, some trials still saw up to 79% of requests succeed, while others dropped to as low as 5%. This inconsistency makes it challenging for security teams to ascertain precisely when a key has been fully invalidated.

Further analysis across multiple Google Cloud regions revealed uneven propagation times:

• us-east1: Approximately 49% median success rate post-deletion.
• europe-west1: Approximately 49% median success rate post-deletion.
• asia-southeast1: Approximately 22% median success rate post-deletion.

Intriguingly, certain geographically distant regions rejected deleted keys faster than some closer ones, suggesting that factors like routing, caching mechanisms, or underlying infrastructure differences play a role in influencing the revocation timing.

Lack of Visibility in Google Cloud Console

Compounding the problem is the lack of clear indication within the Google Cloud Console that a “deleted” key might still be active. Upon deletion:

• The key immediately disappears from the console interface.
• However, ongoing requests using that key may continue to succeed without any visible warning to the user.
• Any failed requests after the key is eventually invalidated are generically grouped under “apikey:UNKNOWN” in logs, making it difficult for security teams to attribute activity to a specific, previously deleted key during incident response.

  Disparity in Credential Revocation Speeds

  Not all Google credentials suffer from the same revocation delay. The research highlighted significant differences:

  • Service account keys: Typically revoked in about 5 seconds.
  • Newer Gemini API keys (those with an “AQ” prefix): Generally revoked in approximately 1 minute.
  • Legacy API keys: The primary subject of this vulnerability, showing delays of up to 23 minutes.

  This disparity strongly suggests that faster revocation mechanisms are technically feasible within Google’s architecture but are not universally applied to standard API keys.

  Aikido researcher Joe Leon stated that Google acknowledged the issue but categorized it as “won’t fix.” Google reportedly described the delay as expected behavior in eventually consistent systems, rather than a security flaw. While Google’s documentation does mention eventual consistency for IAM systems, it does not explicitly warn users about the specific, extended delays in API key revocation.

  Security Implications

  This delayed revocation directly contradicts the common expectation that deleting credentials instantly nullifies their access. Even brief delays can be exploited, a fact well-established by prior cloud security research. For organizations heavily reliant on Google Cloud, this creates several critical risks:

  • Continued Access Post-Compromise: If an API key is leaked or stolen, deleting it does not immediately mitigate the threat, allowing attackers a window of continued access.
  • Lack of Visibility: Security teams struggle to monitor or confirm the true invalidation of a key, hindering effective incident response.
  • Impaired Just-in-Time (JIT) Strategies: Organizations implementing JIT credential provisioning or short-lived keys find their security posture undermined by these delays.

  What You Should Do

  Until Google implements changes to address this revocation gap, security teams must proactively adjust their strategies:

  • Assume Extended Revocation: Treat API key deletion as a process that could take up to 30 minutes, rather than an immediate action.
  • Intensive Post-Deletion Monitoring: Implement rigorous API usage monitoring immediately after deleting a compromised key to detect any continued suspicious activity.
  • Proactive Key Management: Regularly rotate API keys and strictly minimize their exposure in public repositories or insecure locations.
  • Prioritize Modern Credential Types: Where feasible, prefer using service account keys or newer API key types (like those with the “AQ” prefix for Gemini) due to their demonstrably faster revocation times.

  Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.

  Tags:

  AttackExploitSecurity