Unauthorized KMS Decryption

Google SecOps@GoogleSecOps

•updated Mar 24, 2025•0•0•1

Detects when a Key Management Service (KMS) decryption operation is carried out by a service account that's not in the allowlist. This behavior may indicate unauthorized access to information.