VM instance has Block project-wide SSH keys enabled

Check ID: compute_instance_block_project_wide_ssh_keys_disabled
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: identity-access, secrets
Resource type: compute.googleapis.com/Instance

What this check verifies

Compute Engine VMs are evaluated for the metadata key block-project-ssh-keys set to true, indicating project-wide SSH keys are blocked and only instance-level or OS Login credentials are honored.

Risk

Allowing project-wide SSH keys lets a single compromised key reach many VMs, amplifying blast radius. This endangers confidentiality (data exposure) and integrity (unauthorized changes) and enables lateral movement. Per-instance revocation and accountability are weakened.

Recommendation

Set block-project-ssh-keys=true to prevent shared key inheritance. Prefer OS Login or instance-specific keys, enforce least privilege and separation of duties for metadata changes, use short-lived credentials with rotation, limit direct SSH, and monitor access for anomalies.

Remediation

CLI
Terraform
Dashboard steps

gcloud compute instances add-metadata <INSTANCE_NAME> --zone <ZONE> --metadata=block-project-ssh-keys=true

resource "google_compute_instance" "vm" {
  name         = "<example_resource_name>"
  zone         = "<ZONE>"
  machine_type = "e2-micro"

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }

  network_interface {
    network = "default"
  }

  metadata = {
    block-project-ssh-keys = "true" # Critical: blocks project-wide SSH keys for this VM
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_block_project_wide_ssh_keys_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Compute Engine VM instances have Automatic Restart enabled Compute instance has Confidential Computing enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires