Other Articles

Compute Engine – Enable OS Login

This check ensures that OS Login is enabled at the project level so that SSH access to Google Cloud Compute Engine VM instances is managed using IAM users instead of static SSH keys.

Check Details

  • Resource: Compute Engine
  • Check: Enforce OS Login
  • Risk: Without OS Login, SSH access is managed using project-wide or instance-level SSH keys, increasing the risk of unauthorized access and poor access governance.

Remediation via Google Cloud Console

  1. Go to the Compute Engine Metadata page: https://console.cloud.google.com/compute/metadata GCP Compute Metadata Page
  2. Click Edit.
  3. Under Custom metadata, add a metadata entry:
    • Key: enable-oslogin
    • Value: TRUE
    Enable OS Login at project level
  4. Click Save to apply the changes.
  5. If any VM instance overrides the project setting, go to the VM Instances page: https://console.cloud.google.com/compute/instances
  6. Click the name of the instance to open the instance details page.
  7. Click Edit.
  8. Under Custom metadata, remove any entry with:
    • Key: enable-oslogin
    • Value: FALSE
  9. Click Save to apply the changes.

Remediation via Google Cloud CLI

  1. Open the Google Cloud Console and click the Cloud Shell icon (>_) in the top-right corner. GCP Cloud Shell
  2. Configure OS Login at the project level: 
    
gcloud compute project-info add-metadata \
 --metadata enable-oslogin=TRUE
  3. Remove instance-level metadata that overrides the project setting: 
    
gcloud compute instances remove-metadata <INSTANCE_NAME> \
 --keys=enable-oslogin

Replace <INSTANCE_NAME> with the name of your Compute Engine VM instance.

Default Value

By default, the enable-oslogin metadata parameter is not set, which is equivalent to setting it to FALSE.