Other Articles

Compute Engine – Block Project-Wide SSH Keys

This check ensures that project-wide SSH keys are blocked for Google Cloud Compute Engine VM instances. Blocking project-wide SSH keys enforces the use of instance-specific SSH keys, reducing the risk of unauthorized access.

Check Details

  • Resource: Compute Engine
  • Check: Block project-wide SSH keys
  • Risk: Project-wide SSH keys allow users to access multiple VM instances, increasing the attack surface and risk of unauthorized access.

Remediation via Google Cloud Console

  1. Log in to the Google Cloud Console and navigate to the VM instances page.
    https://console.cloud.google.com/compute/instances GCP VM Instances Page
  2. Click on the name of the impacted VM instance.
  3. Click Edit in the top toolbar. Edit VM Instance
  4. Scroll to the SSH Keys section.
  5. Select the checkbox Block project-wide SSH keys. Block Project-Wide SSH Keys
  6. Click Save at the bottom of the page.
  7. Repeat these steps for every impacted VM instance.

Remediation via Google Cloud CLI

  1. Open the Google Cloud Console and click the Cloud Shell icon (>_) in the top-right corner. GCP Cloud Shell
  2. Block project-wide SSH keys for the VM instance by running:
    
    gcloud compute instances add-metadata <INSTANCE_NAME> \
    --metadata block-project-ssh-keys=TRUE
    
    Block Project-Wide SSH Keys

Replace <INSTANCE_NAME> with the name of the Compute Engine VM instance.

Default Value

By default, Block project-wide SSH keys is not enabled for Compute Engine VM instances.