Back to Checks
gcp

VM instance has Block project-wide SSH keys enabled

compute_instance_block_project_wide_ssh_keys_disabled
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesssecrets
Resource Type:compute.googleapis.com/Instance

Compute Engine VMs are evaluated for the metadata key block-project-ssh-keys set to true, indicating project-wide SSH keys are blocked and only instance-level or OS Login credentials are honored.

Prowler logoProwlerprowler-provider-gcp

Risk

Allowing project-wide SSH keys lets a single compromised key reach many VMs, amplifying blast radius. This endangers confidentiality (data exposure) and integrity (unauthorized changes) and enables lateral movement. Per-instance revocation and accountability are weakened.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_block_project_wide_ssh_keys_disabled

Recommendation

Set block-project-ssh-keys=true to prevent shared key inheritance. Prefer OS Login or instance-specific keys, enforce least privilege and separation of duties for metadata changes, use short-lived credentials with rotation, limit direct SSH, and monitor access for anomalies.

Remediation

CLI

gcloud compute instances add-metadata <INSTANCE_NAME> --zone <ZONE> --metadata=block-project-ssh-keys=true

Terraform

resource "google_compute_instance" "vm" {
  name         = "<example_resource_name>"
  zone         = "<ZONE>"
  machine_type = "e2-micro"

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }

  network_interface {
    network = "default"
  }

  metadata = {
    block-project-ssh-keys = "true" # Critical: blocks project-wide SSH keys for this VM
  }
}

Other

1In Google Cloud Console, go to Compute Engine > VM instances
2Click the target VM and then click Edit
3Under Custom metadata, click Add item
4Key: block-project-ssh-keys, Value: true
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_block_project_wide_ssh_keys_disabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in compute_client.instances:
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
            report.status = "FAIL"
            report.status_extended = f"The VM Instance {instance.name} is making use of common/shared project-wide SSH key(s)."
            if instance.metadata.get("items"):
                for item in instance.metadata["items"]:
                    if (
                        item["key"] == "block-project-ssh-keys"
                        and item["value"].lower() == "true"
                    ):
                        report.status = "PASS"
                        report.status_extended = f"The VM Instance {instance.name} is not making use of common/shared project-wide SSH key(s)."
                        break
            findings.append(report)

        return findings

References