Enable OS Login for GCP Projects

Sign in to Google Cloud Management Console.

Select the GCP project that you want to examine from the console top navigation bar.

Navigate to Google Compute Engine dashboard at https://console.cloud.google.com/compute.

In the navigation panel, select Metadata to access the metadata available for the virtual machine (VM) instances provisioned within the selected project.

Select the Metadata tab and check for any metadata key pair with the name enable-oslogin. If there is no metadata key named enable-oslogin or the enable-oslogin key exists but the key value is set to FALSE, the OS Login feature is not enabled at the Google Cloud Platform (GCP) project level.

Because VM instances can override GCP project settings, ensure there are no instances with enable-oslogin key set to FALSE within the selected project. In the navigation panel, select VM instances to access the list with the virtual machine (VM) instances provisioned for the selected project.

Click on the name of the instance that you want to examine.

Select the Details tab to access the instance configuration details and check the Custom metadata section for a key pair with the name enable-oslogin. If there is no custom metadata key named enable-oslogin, then the VM will inherit the project-level settings. If the enable-oslogin key exists but the key value is set to FALSE, the OS Login feature is not enabled for the selected Google Compute Engine instance.

Repeat step no. 7 and 8 for each virtual machine instance created within the selected project.

Repeat steps no. 2 – 9 for each project deployed in your Google Cloud account.

Run projects list command (Windows/macOS/Linux) using custom query filters to list the IDs of all the Google Cloud Platform (GCP) projects available in your Google Cloud account:

gcloud projects list
	--format="table(projectId)"

The command output should return the requested GCP project IDs:

PROJECT_ID
cc-web-stack-project-123123
cc-ml-custom-project-112233

Run compute project-info describe command (Windows/macOS/Linux) using the ID of the GCP project that you want to examine as identifier parameter and custom query filters to describe the metadata items associated with the selected project:

gcloud compute project-info describe
	--project cc-web-stack-project-123123
	--format="json(commonInstanceMetadata.items)"

The command output should return the requested GCP project metadata items:

{
  "commonInstanceMetadata": {
    "items": [
      {
        "key": "enable-oslogin",
        "value": "FALSE"
      },
      {
        "key": "ssh-keys",
        "value": "instance-admin:ssh-rsa ... \"expireOn\":\"2020-05-12T08:10:40+0000\"}"
      }
    ]
  }
}

If the compute project-info describe command output does not return any metadata items with the key name set to "enable-oslogin", or the "enable-oslogin" item exists but the item value is set to "FALSE", as shown in the output example above, the OS Login feature is not enabled at the Google Cloud Platform (GCP) project level.

Because VM instances can override GCP project settings, ensure there are no instances with "enable-oslogin" metadata key set to "FALSE" within the selected project. Run compute instances list command (Windows/macOS/Linux) using the ID of the verified GCP project as identifier parameter and custom filtering to describe the name and zone for each VM instance provisioned in the selected project:

gcloud compute instances list
	--project cc-web-stack-project-123123
	--format="table(name,zone)"

The command output should return the name(s) of the instance(s) within the selected GCP project:

NAME                      ZONE
cc-backend-vm-instance    us-central1-a
cc-frontend-vm-instance   us-central1-a

Run compute instances describe command (Windows/macOS/Linux) using the name and the zone of the instance that you want to examine as identifier parameter and custom filtering to describe the metadata items created for the selected virtual machine (VM) instance:

gcloud compute instances describe cc-backend-vm-instance
	--zone us-central1-a
	--format="json(metadata.items)"

The command output should return the requested VM instance metadata items:

{
  "metadata": {
    "items": [
      {
        "key": "enable-oslogin",
        "value": "FALSE"
      },
      {
        "key": "block-project-ssh-keys",
        "value": "true"
      },
      {
        "key": "ssh-keys",
        "value": "web-instance-rsa-key:ssh-rsa ... web-instance-rsa-key"
      }
    ]
  }
}

If the command output does not return any metadata items with the key name set to "enable-oslogin", then the VM will inherit the project-level settings. If the "enable-oslogin" item exists but its value is set to "FALSE", the OS Login feature is not enabled for the selected Google Compute Engine instance.

Repeat step no. 7 and 8 for each virtual machine instance provisioned within the selected project.

Repeat steps no. 3 – 7 for each GCP project deployed in your Google Cloud account.

Sign in to Google Cloud Management Console.

Select the GCP project that you want to examine from the console top navigation bar.

Navigate to Google Compute Engine dashboard at https://console.cloud.google.com/compute.

In the navigation panel, select Metadata to access the metadata available for the virtual machine (VM) instances deployed within the selected project.

Select the Metadata tab and click Edit to enter the edit mode.

On the Metadata panel, click Add item and add a metadata entry where the Key is enable-oslogin and the Value is TRUE.

Click Save to apply the changes. Once the metadata item is saved, the OS Login feature is enabled for the selected Google Cloud project.

In the navigation panel, select VM instances to access the list with the virtual machine (VM) instances provisioned for the selected project.

Click on the name of the instance that overrides the GCP project metadata and has the enable-oslogin metadata item set to FALSE (see Audit section part I to identify the right instance).

On the selected resource configuration page, click EDIT to enter the edit mode.

In the Custom metadata section, remove any metadata entry with the Key set to enable-oslogin and the Value set to FALSE.

Click Save to apply the configuration changes.

If required, repeat steps no. 9 – 12 to reconfigure other virtual machine instances created for the selected project.

Repeat steps no. 2 – 13 for each GCP project available in your Google Cloud account.

Run compute project-info add-metadata command (Windows/macOS/Linux) using the ID of the GCP project that you want to reconfigure as identifier parameter (see Audit section part II to identify the right resource), to enable the OS Login feature for the selected project:

gcloud compute project-info add-metadata
	--project cc-web-stack-project-123123
	--metadata enable-oslogin=TRUE

The command output should return the URL of the reconfigured Google Cloud project:

Updated [https://www.googleapis.com/compute/v1/projects/cc-web-stack-project-123123].

Run compute instances remove-metadata command (Windows/macOS/Linux) using the name of the VM instance that overrides the GCP project metadata as identifier parameter (see Audit section part II to identify the right instance), to remove the enable-oslogin metadata item from the selected Google Compute Engine instance:

gcloud compute instances remove-metadata cc-backend-vm-instance
	--zone us-central1-a
	--keys=enable-oslogin

The command output should return the URL of the reconfigured VM instance:

pdated [https://www.googleapis.com/compute/v1/projects/cc-web-stack-project-123123/zones/us-central1-a/instances/cc-backend-vm-instance].

If required, repeat steps no. 1 – 4 to reconfigure other virtual machine instances available within the selected project.

Repeat steps no. 1 – 5 for each GCP project deployed in your Google Cloud account.