A user/service account with overly permissive KMS related roles was found. It is recommended that the principle of 'Separation of Duties' is enforced while assigning KMS related roles to users. No user should have Cloud KMS Admin and any of the Cloud KMS CryptoKey Encrypter/Decrypter, Cloud KMS CryptoKey Encrypter, Cloud KMS CryptoKey Decrypter roles assigned at the same time.