Choose an access method

If you have Linux virtual machine (VM) instances running on Google Cloud, you might need to share or restrict user or application access to your VMs.

• If you need to manage user access to your Linux VM instances, you can use one of the following methods:

  • OS Login
  • Managing SSH keys in metadata
  • Temporarily grant a user access to an instance

• If you need to manage application access to your VM instances, see Use SSH with service accounts.

Managing user access

Caution: Users who can connect to a VM can access the VM's metadata server to retrieve an access token. The access token lets users impersonate the VM's service account and use all IAM permissions granted to the service account, even if their account does not have the permissions required. You can mitigate this risk by using OS Login which ensures that users who log in to a VM are granted permission to the VM's service account.

OS Login

In most scenarios, we recommend using OS Login. The OS Login feature lets you use Compute Engine IAM roles to manage SSH access to Linux instances. You can add an extra layer of security by setting up OS Login with two-factor authentication, and manage access at the organization level by setting up organization policies.

Manage SSH keys in metadata

If you are running your own directory service for managing access, or are otherwise unable to set up OS Login, you can manually manage SSH keys in metadata.

Note: If you connect to Linux VMs using the Google Cloud console or the Google Cloud CLI, Compute Engine creates SSH keys on your behalf. For more information on how Compute Engine configures and stores keys, see About SSH connections to Linux VMs.

Risks of manual key management

If you create and manage public SSH keys yourself through the console, the Google Cloud CLI, or the API, you must keep track of the used keys and delete the public SSH keys for users who no longer have access. For example, if a team member leaves your project, remove their public SSH keys from metadata, so they can't continue to access your instances.

Additionally, specifying your gcloud CLI or API calls incorrectly can potentially wipe out all of the public SSH keys in your project or on your instances, which disrupts connections for your project members.

If you aren't sure that you want to manage your own keys, use Compute Engine tools to connect to your instances instead.

What's next?

• Learn how to set up OS Login.
• Learn how to create SSH keys.
• Learn how to add SSH keys to VMs.
• Learn how to restrict SSH keys from VMs.