Back to Checks
gcp

Project has OS Login enabled

compute_project_os_login_enabled
Service: computeSeverity: low
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:compute.googleapis.com/Project

Project metadata has OS Login enabled (enable-oslogin), so VM SSH access uses IAM-linked Linux identities instead of static project or instance keys.

Prowler logoProwlerprowler-provider-gcp

Risk

Without OS Login, SSH relies on static metadata keys that are hard to rotate and revoke. Leaked or orphaned keys can retain VM access, enabling unauthorized commands, data exfiltration, and lateral movement-impacting confidentiality and integrity and weakening accountability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_project_os_login_enabled

Recommendation

Enable OS Login at the project level to centralize SSH through IAM.

  • Apply least privilege to OS Login roles
  • Remove metadata SSH keys
  • Enforce MFA and short-lived credentials
  • Monitor login activity and add network restrictions for defense in depth

Remediation

CLI

gcloud compute project-info add-metadata --metadata enable-oslogin=TRUE

Terraform

resource "google_compute_project_metadata_item" "<example_resource_name>" {
  # Critical: this key/value enables OS Login at the project level
  key   = "enable-oslogin"
  value = "TRUE"
}

Other

1In Google Cloud Console, select your project
2Go to Compute Engine > Metadata
3Click Edit > Add item
4Set Key to enable-oslogin and Value to TRUE
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_project_os_login_enabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for project in compute_client.compute_projects:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=compute_client.projects[project.id],
                project_id=project.id,
                location=compute_client.region,
                resource_name=(
                    compute_client.projects[project.id].name
                    if compute_client.projects[project.id].name
                    else "GCP Project"
                ),
            )
            report.status = "PASS"
            report.status_extended = f"Project {project.id} has OS Login enabled."
            if not project.enable_oslogin:
                report.status = "FAIL"
                report.status_extended = (
                    f"Project {project.id} does not have OS Login enabled."
                )
            findings.append(report)

        return findings

References