Google API Keys Remain Active for Up to 23 Minutes Post-Deletion, Posing Security Risk

A recent report by security researchers highlights a significant concern for Google Cloud Platform (GCP) users: deleted API keys can continue to function for an alarming period, up to 23 minutes, after they have been ostensibly removed from the system. This finding challenges the common assumption that deleting a compromised key immediately revokes its access, leaving a substantial window for potential exploitation. The researchers conducted trials using keys with access to various GCP APIs, including Gemini, BigQuery, and Maps, and observed consistent behavior across them. The delay is attributed to the 'eventually consistent' nature of many Google Cloud services, a design choice that prioritizes global scalability and speed by gradually propagating updates across servers. While beneficial for performance, this architectural decision introduces a critical lag in security-sensitive operations like credential revocation. During this post-deletion window, an attacker who has compromised an API key could continue to make API requests, incur charges, and potentially access sensitive data or functionalities, particularly if the key was scoped to powerful services like the Gemini AI. The implications are severe, ranging from unexpected billing to data breaches. Interestingly, the researchers noted that newer API key formats, specifically those for the Gemini API, and Google Service Account keys demonstrated significantly faster revocation times, approximately 1 minute and 5 seconds respectively. This suggests that a more immediate revocation process is technically achievable within Google's infrastructure. However, Google has reportedly stated that this delayed revocation is a 'known property of the system and not a security issue,' indicating no immediate plans for a universal fix. In light of this, users are advised to treat API key deletion as an operation that could take up to 30 minutes to fully propagate. During this period, it is crucial to actively monitor API usage in the GCP console under 'Enabled APIs and services' to detect and mitigate any unauthorized activity. The discrepancy between the UI's promise that a key 'can no longer be used to make API requests' and the actual observed behavior further complicates the situation for users.