Check ID: compute_project_os_login_2fa_enabled
Provider: GCP
Service: compute
Severity: HIGH
Categories: identity-access
Resource type: compute.googleapis.com/Project

​
What this check verifies

OS Login Two-Factor Authentication (2FA) requires users to verify their identity with a second factor when connecting via SSH to VM instances. This provides an additional security layer beyond passwords or SSH keys, significantly reducing the risk of unauthorized access even if credentials are compromised.

​
Risk

Without 2FA enforcement, compromised credentials (stolen SSH keys or passwords) grant immediate access to VM instances. Attackers could:
  • Gain unauthorized shell access to production systems
  • Exfiltrate sensitive data or deploy malware
  • Move laterally within the infrastructure
This single point of failure significantly increases the attack surface.

​
Recommendation

Enable OS Login with 2FA at the project level to enforce multi-factor authentication for all SSH connections. This adds a critical security layer by requiring users to complete a second verification step, protecting against credential theft and unauthorized access.

​
Remediation

gcloud compute project-info add-metadata --metadata enable-oslogin=TRUE,enable-oslogin-2fa=TRUE

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_project_os_login_2fa_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks