OS Login
A Compute Engine feature that ties SSH access to a user's actual Google Identity and IAM permissions, rather than manually managing individual SSH public keys per VM. Enabling OS Login means revoking a departing employee's GCP access also immediately revokes their SSH access to every VM, with no separate key cleanup needed.
Frequently Asked Questions
How does OS Login change SSH key management compared to the default Compute Engine metadata-based SSH keys?
Without OS Login, SSH public keys are added to VM or project metadata manually or via automation, and there's no built-in link between a key and a specific person's ongoing employment status — a departed employee's key has to be found and removed individually, per VM or project. OS Login ties SSH access directly to a Google Identity and IAM role (`roles/compute.osLogin` or `osAdminLogin`), so access is granted and revoked the same way any other IAM permission is, and Cloud Audit Logs record who logged into which VM.
What's a common gotcha when enabling OS Login on an existing GCP project?
Enabling OS Login at the project level (`enable-oslogin=TRUE` metadata) overrides any per-VM SSH keys already configured, which can unexpectedly lock out automation or scripts that relied on static keys until they're migrated to use IAM-based access or OS Login's own key management. It's also commonly missed that two-factor enforcement for OS Login is a separate metadata flag (`enable-oslogin-2fa`), not something that comes bundled automatically with OS Login itself.