# 4.3 Ensure “Block Project-Wide SSH Keys” Is Enabled for VM Instances (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233017-4-3-ensure-block-project-wide-ssh-keys-is-enabled-for-vm-instances-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: Level 1 ### Description: Enabling Block Project-Wide SSH Keys for VM instances ensures that only instance-specific SSH keys are used for access, preventing the use of shared project-wide SSH keys. ### Rationale: Project-wide SSH keys, stored in Compute Engine project metadata, provide access to all instances in a project. This approach simplifies SSH key management but increases security risks. If project-wide SSH keys are compromised, all instances within the project are vulnerable. By using instance-specific SSH keys, access is limited to individual instances, reducing the potential attack surface. ### Impact: - Users relying on project-wide SSH keys will lose access to affected instances. - Users accessing instances via the gcloud command-line tool or GCP Console SSH feature will not need manual key distribution. - For users using third-party SSH clients, instance-specific SSH keys must be manually created and distributed. ### Default Value: By default, Block Project-Wide SSH Keys is not enabled for VM instances. ### Audit Steps: #### From Google Cloud Console: 1. Navigate to the VM Instances page: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).                          ![](https://support.icompaas.com/assets/kb/cdd64db8ee7c808c.png) 2. Click the name of each instance to view its details.                    ![](https://support.icompaas.com/assets/kb/1788ec0d44f9341d.png) 3. Under SSH Keys, verify that Block project-wide SSH keys is selected.                     ![](https://support.icompaas.com/assets/kb/33f2d45c7c256914.png) #### From Google Cloud CLI: List all instances and check their metadata: gcloud compute instances list --format=json 1. Ensure the metadata key block-project-ssh-keys is set to true for all instances. ### Remediation Steps: #### From Google Cloud Console: 1. Navigate to the VM Instances page: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).                                  ![](https://support.icompaas.com/assets/kb/3c7247146d68d6c0.png) 2. Click the name of the affected instance.                  ![](https://support.icompaas.com/assets/kb/0e3433b525a69f96.png) 3. Click Edit in the toolbar.                ![](https://support.icompaas.com/assets/kb/466350841a0d6cab.png) 4. Under SSH Keys, select the checkbox Block project-wide SSH keys.                    ![](https://support.icompaas.com/assets/kb/a85973c4dac9ff7d.png) 5. Click Save at the bottom of the page.                     ![](https://support.icompaas.com/assets/kb/6eb203b88f6a8606.png) 6. Repeat these steps for all impacted instances. #### From Google Cloud CLI: Set the block-project-ssh-keys metadata value to true: gcloud compute instances add-metadata --metadata block-project-ssh-keys=TRUE ### References: 1. [Adding and Removing SSH Keys](https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys) 2. [gcloud Formats](https://cloud.google.com/sdk/gcloud/reference/topic/formats) ### Additional Information: - If OS Login is enabled, SSH keys in instance metadata are ignored, and blocking project-wide SSH keys is unnecessary. ### CIS Controls:

Control

Description

IG 1

IG 2

IG 3

3.10 Encrypt Sensitive Data in Transit

Encrypt sensitive data in transit using protocols like TLS and SSH.

✅

✅


5.2 Use Unique Passwords

Use unique passwords for enterprise assets to reduce unauthorized access risks.

✅

✅

✅

16.5 Encrypt Credential Transmittals

Ensure all usernames and authentication credentials are transmitted using encrypted channels.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.