Skip to main content

🛡️ Google GCE Project OS Login is not enabled🟢

Stats​

not available

Logic​

Similar Policies​

Description​

Open File

Description​

This policy checks whether OS Login is enabled at the Google Cloud project level for projects with running Google Compute Engine instances. OS Login links SSH access to Cloud IAM identities and reduces reliance on SSH keys stored in project or instance metadata.

Rationale​

Enabling OS Login centralizes SSH access management through IAM. When access is removed from an IAM user, the associated SSH access is also removed. This helps manage SSH access consistently and reduces the operational risk of unmanaged or stale SSH keys.

Project-level OS Login can be overridden by instance metadata. A running instance that sets enable-oslogin to FALSE disables the project-level control for that instance.

Impact​

Enabling OS Login at the project level disables metadata-based SSH key configurations for instances in the project. If OS Login is later disabled, SSH keys configured in project or instance metadata are restored.

Audit​

This policy flags a Google Project as INCOMPLIANT when both of the following conditions are met:

... see more

Remediation​

Open File

Remediation​

From Google Cloud Console​

  1. Go to the VM compute metadata page by visiting: https://console.cloud.google.com/compute/metadata.
  2. Click Edit.
  3. Add a metadata entry where the key is enable-oslogin and the value is TRUE.
  4. Click Save to apply the changes.
  5. For every instance that overrides the project setting, go to the VM Instances page at https://console.cloud.google.com/compute/instances.
  6. Click the name of the instance on which you want to remove the metadata value.
  7. At the top of the instance details page, click Edit to edit the instance settings.
  8. Under Custom metadata, remove any entry with key enable-oslogin and the value is FALSE
  9. At the bottom of the instance details page, click Save to apply your changes to the instance.

From Google Cloud CLI​

  1. Configure oslogin on the project:

    gcloud compute project-info add-metadata \
        --metadata enable-oslogin=TRUE

  2. Remove instance metadata that overrides the project setting.

    gcloud compute instances remove-metadata {{instance-name}} \

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS GCP v1.2.0 → 💼 4.4 Ensure oslogin is enabled for a Project - Level 1 (Automated)1no data
💼 CIS GCP v1.3.0 → 💼 4.4 Ensure Oslogin Is Enabled for a Project - Level 1 (Automated)1no data
💼 CIS GCP v2.0.0 → 💼 4.4 Ensure Oslogin Is Enabled for a Project - Level 1 (Automated)1no data
💼 CIS GCP v3.0.0 → 💼 4.4 Ensure Oslogin Is Enabled for a Project - Level 1 (Automated)1no data
💼 CIS GCP v4.0.0 → 💼 4.4 Ensure Oslogin Is Enabled for a Project - Level 1 (Automated)1no data
💼 CIS GCP v5.0.0 → 💼 4.4 Ensure Oslogin Is Enabled for a Project - Level 1 (Automated)1no data
💼 Cloudaware Framework → 💼 Secure Access61no data
💼 FedRAMP High Security Controls → 💼 AC-2 Account Management (L)(M)(H)10859no data
💼 FedRAMP Low Security Controls → 💼 AC-2 Account Management (L)(M)(H)9no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2 Account Management (L)(M)(H)959no data
💼 ISO/IEC 27001:2022 → 💼 5.15 Access control1532no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events185no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events105no data
💼 NIST CSF v2.0 → 💼 PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization47no data
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties144no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected197no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2 Account Management132158no data
💼 SOC 2 → 💼 CC6.1-4 Identifies and Authenticates Users46no data
💼 SOC 2 → 💼 CC6.1-6 Manages Points of Access57no data
💼 SOC 2 → 💼 CC6.1-8 Manages Identification and Authentication1825no data
💼 SOC 2 → 💼 CC6.1-9 Manages Credentials for Infrastructure and Software34no data