OS Login Quotas

Stay organized with collections Save and categorize content based on your preferences.

This document describes the quotas for OS Login, which define the maximum number of requests that your project can make to the OS Login API.

A quota restricts how much of a particular shared Google Cloud resource your Cloud project can use, including hardware, software, and network components.

Quotas are part of a system that does the following:

  • Monitors your use or consumption of Google Cloud products and services.
  • Restricts your consumption of those resources for reasons including ensuring fairness and reducing spikes in usage.
  • Maintains configurations that automatically enforce prescribed restrictions.
  • Provides a means to make or request changes to the quota.

When a quota is exceeded, in most cases, the system immediately blocks access to the relevant Google resource, and the task that you're trying to perform fails. In most cases, quotas apply to each Cloud project and are shared across all applications and IP addresses that use that Cloud project.

Request Quotas

Any requests you make to the OS Login API count towards your OS Login quota. OS Login usage through the Google Cloud console or Google Cloud CLI also counts towards your quota because these services use the OS Login API. OS Login quotas apply to your entire project and are separate for each project.

Each quota group is counted separately, so you can achieve the maximum limit in each group simultaneously. Quotas are enforced at intervals of every 60 seconds. If you reach a group's enforced maximum anytime within 60 seconds, you need to wait for the next interval for your quota to refresh before you can make more requests in that group.

Per user quotas

Quota group Details Default quota
Read requests
  • Description: Quota for *.get, and *.getLoginProfile methods.
  • Metric: oslogin.googleapis.com/read_requests

    View this quota in the Cloud Console:

    Go to Quotas

60 requests per user per minute
Write requests
  • Description: Limit for *.create, *.patch, *.delete and *.importSshPublicKey methods.
  • Metric: oslogin.googleapis.com/write_requests

    View this quota in the Cloud Console:

    Go to Quotas

60 requests per user per minute
Start session requests
  • Description: Limit for initiating OS Login two-factor authentication attempts.
  • Metric: oslogin.googleapis.com/start_session_requests

    View this quota in the Cloud Console:

    Go to Quotas

6 requests per user per minute
Continue session requests
  • Description: Limit for completing OS Login two-factor authentication attempts.
  • Metric: oslogin.googleapis.com/continue_session_requests

    View this quota in the Cloud Console:

    Go to Quotas

6 requests per user per minute

Per region quotas

Quota group Details Default quota
Metadata server requests
  • Description: Limit for calls to the metadata server for OS Login connection authorization checks and user lookups.

    OS Login makes calls to the metadata server to retrieve OS Login users during the following operations:

    • When a VM is created. OS Login caches the result.
    • When a user attempts to connect to a VM.
    • When system processes search for a user that isn't in the cache.
  • Metric: oslogin.googleapis.com/metadata_server_requests

    View this quota in the Cloud Console:

    Go to Quotas

60,000 requests per region per minute
Metadata server group requests
  • Description: Limit for calls to the metadata server for OS Login group lookups. If VMs don't have OS Login groups configured, metadata server groups quota might be consumed, but consumption has no impact on VM performance.

    OS Login makes calls to the metadata server to retrieve OS Login groups during the following operations:

    • When a VM is created. OS Login caches the result.
    • When system processes search for a group that isn't in the cache.
  • Metric: oslogin.googleapis.com/metadata_server_groups_requests

    View this quota in the Cloud Console:

    Go to Quotas

60 requests per region per minute

Manage quotas

To manage the quotas for your project, do the following:

What's next?