GCP KMS doesn't support checking AAD (encryption context) as an IAM condition

[kthhrv]

this means to provide app/env separation in GCP separate Keys and SAs for each app/env would be required.

I've logged https://issuetracker.google.com/issues/434633824 lol