Project has OS Login enabled

Check ID: compute_project_os_login_enabled
Provider: GCP
Service: compute
Severity: LOW
Categories: identity-access
Resource type: compute.googleapis.com/Project

What this check verifies

Project metadata has OS Login enabled (enable-oslogin), so VM SSH access uses IAM-linked Linux identities instead of static project or instance keys.

Risk

Without OS Login, SSH relies on static metadata keys that are hard to rotate and revoke. Leaked or orphaned keys can retain VM access, enabling unauthorized commands, data exfiltration, and lateral movement-impacting confidentiality and integrity and weakening accountability.

Recommendation

Enable OS Login at the project level to centralize SSH through IAM.

Apply least privilege to OS Login roles
Remove metadata SSH keys
Enforce MFA and short-lived credentials
Monitor login activity and add network restrictions for defense in depth

Remediation

CLI
Terraform
Dashboard steps

gcloud compute project-info add-metadata --metadata enable-oslogin=TRUE

resource "google_compute_project_metadata_item" "<example_resource_name>" {
  # Critical: this key/value enables OS Login at the project level
  key   = "enable-oslogin"
  value = "TRUE"
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_project_os_login_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

GCP project has OS Login with 2FA enabled Public IP address is not listed in Shodan

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires