Description

Ensure that OS Login is enabled for the project (or organization) and that two-factor authentication (2FA) is enforced for OS Login, so that SSH access to Compute Engine VM instances is tied to individual Google identities with strong authentication, rather than relying solely on manually managed SSH key metadata.

Rationale

Without OS Login, SSH access to VM instances is typically managed via SSH keys added to project or instance metadata, which does not provide centralized, per-user access revocation, auditability, or multi-factor enforcement. Enabling OS Login ties SSH access to IAM identities and Cloud Identity accounts, allowing access to be centrally managed and immediately revoked when a user's IAM permissions are removed, and enforcing 2FA on top of OS Login adds an additional authentication factor that significantly reduces the risk of unauthorized SSH access from a compromised password or key alone.

Impact

  • Centralizes SSH access management around IAM identities rather than static SSH key metadata

  • Enables immediate revocation of SSH access when a user's IAM permissions are removed

  • Requires users to complete two-factor authentication before establishing an SSH session, reducing the risk of unauthorized access

  • Requires users to have 2-Step Verification configured on their Google identity

Default Value

OS Login is disabled by default at the project level, and even when OS Login is enabled, two-factor authentication enforcement (enable-oslogin-2fa) is not enabled by default and must be configured separately.

Pre-Requisites

  • Cloud Identity or Google Workspace accounts with 2-Step Verification available to users

  • IAM permissions to set project/instance metadata (e.g., Compute Instance Admin, Project IAM Admin)

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > Settings > Metadata.

  4. Verify that a metadata entry enable-oslogin is present and set to TRUE.

  5. Verify that a metadata entry enable-oslogin-2fa is present and set to TRUE.

  6. Check individual instances for metadata overrides that might disable OS Login or 2FA at the instance level.

  7. If OS Login or 2FA enforcement is missing, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > Settings > Metadata.

  4. Select Edit, then add a metadata entry with key enable-oslogin and value TRUE.

  5. Add a second metadata entry with key enable-oslogin-2fa and value TRUE.

  6. Click Save to apply the project-wide metadata.

  7. Review individual instances for any enable-oslogin or enable-oslogin-2fa metadata overrides set to FALSE, and correct them as needed.

  8. Grant users the appropriate IAM role (Compute OS Login or Compute OS Admin Login) to allow OS Login-based SSH access.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > Settings > Metadata.

  4. Select Edit and set enable-oslogin-2fa to FALSE, or remove the entry, to disable two-factor enforcement.

  5. Set enable-oslogin to FALSE, or remove the entry, if OS Login itself should be disabled.

  6. Click Save to apply the change.

Reference