Back to Checks
gcp

GCP project has OS Login with 2FA enabled

compute_project_os_login_2fa_enabled
Service: computeSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:compute.googleapis.com/Project

OS Login Two-Factor Authentication (2FA) requires users to verify their identity with a second factor when connecting via SSH to VM instances.

This provides an additional security layer beyond passwords or SSH keys, significantly reducing the risk of unauthorized access even if credentials are compromised.

Prowler logoProwlerprowler-provider-gcp

Risk

Without 2FA enforcement, compromised credentials (stolen SSH keys or passwords) grant immediate access to VM instances. Attackers could:

  • Gain unauthorized shell access to production systems
  • Exfiltrate sensitive data or deploy malware
  • Move laterally within the infrastructure

This single point of failure significantly increases the attack surface.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_project_os_login_2fa_enabled

Recommendation

Enable OS Login with 2FA at the project level to enforce multi-factor authentication for all SSH connections. This adds a critical security layer by requiring users to complete a second verification step, protecting against credential theft and unauthorized access.

Remediation

CLI

gcloud compute project-info add-metadata --metadata enable-oslogin=TRUE,enable-oslogin-2fa=TRUE

Terraform

resource "google_compute_project_metadata" "example_resource" {
  metadata = {
    enable-oslogin     = "TRUE"
    enable-oslogin-2fa = "TRUE"  # Enables 2FA for OS Login
  }
}

Other

1Navigate to **Compute Engine** > **Metadata** in Google Cloud Console
2Click **Edit**
3Add or update metadata entry with key `enable-oslogin-2fa` and value `TRUE`
4Ensure `enable-oslogin` is also set to `TRUE`
5Click **Save**

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_project_os_login_2fa_enabled(Check):
    """Ensure that OS Login with 2FA is enabled for a GCP project.

    This check verifies that OS Login Two-Factor Authentication (2FA) is enabled
    at the project level to enforce an additional layer of security for SSH access
    to VM instances.

    - PASS: Project has OS Login 2FA enabled (enable-oslogin-2fa=TRUE).
    - FAIL: Project does not have OS Login 2FA enabled.
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []
        for project in compute_client.compute_projects:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=compute_client.projects[project.id],
                project_id=project.id,
                location=compute_client.region,
                resource_name=(
                    compute_client.projects[project.id].name
                    if compute_client.projects[project.id].name
                    else "GCP Project"
                ),
            )
            report.status = "PASS"
            report.status_extended = f"Project {project.id} has OS Login 2FA enabled."
            if not project.enable_oslogin_2fa:
                report.status = "FAIL"
                report.status_extended = (
                    f"Project {project.id} does not have OS Login 2FA enabled."
                )
            findings.append(report)

        return findings

References