部分 Google Cloud 服務具有 Google 代管的服務帳戶，可讓服務存取您的資源。這些服務帳戶有時也稱為服務代理。如要進一步瞭解服務代理，請參閱「服務代理」。
VM 管理員會使用服務代理程式管理 VM，該代理程式會代您收集 VM 相關資訊。這個由 Google 代管的服務代理電子郵件地址為 service-PROJECT_NUMBER@gcp-sa-osconfig.iam.gserviceaccount.com。此帳戶會使用 Cloud OS 設定服務代理程式角色 (roles/osconfig.serviceAgent)。
您可以在 Google Cloud 控制台的 IAM 頁面中，查看專案的服務代理和授予服務代理的角色。不過，如果您已撤銷服務代理的 Cloud OS Config 服務代理角色，就無法在 IAM 頁面上查看服務代理。
OS 套件和更新來源
無論是修補程式還是 OS 政策，VM 都必須能夠存取套件來源和存放區。如要讓私人網路中的 VM 使用 私人 Google 存取權，您可以設定私人 Google 存取權。
VM 管理員和 Terraform
您可以使用 Terraform 將 VM 管理員的範圍擴大至 Google Cloud 機構中的多個專案。如要瞭解如何使用 Terraform 和 VM Manager 建立修補工作和 OS 政策指派，請參閱 OS Config GitHub 存放區中的 Terraform 範例和教學課程。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eVM Manager is a suite of tools designed to efficiently manage operating systems for large virtual machine (VM) fleets on Compute Engine, supporting both Windows and Linux.\u003c/p\u003e\n"],["\u003cp\u003eThe VM Manager suite includes Patch for applying updates and managing compliance, OS inventory management for collecting and reviewing OS information, and OS policies for software package management.\u003c/p\u003e\n"],["\u003cp\u003eEnabling VM Manager, either automatically or manually, activates the OS Config service API and the OS Config agent on selected VMs through instance metadata.\u003c/p\u003e\n"],["\u003cp\u003eThe OS Config agent utilizes OS system utilities to manage patching, maintain OS policy states, and gather inventory data, which is then stored in instance metadata and log streams.\u003c/p\u003e\n"],["\u003cp\u003eVM Manager's functionality can be expanded across multiple projects in a Google Cloud organization using Terraform, allowing for the creation of patch jobs and OS policy assignments.\u003c/p\u003e\n"]]],[],null,["VM Manager is a suite of tools that can be used to manage operating\nsystems for large virtual machine (VM) fleets running Windows and Linux\non Compute Engine.\n\nVM Manager helps drive efficiency through\nautomation and reduces the operational burden of maintaining these VM fleets.\n\nVM Manager supports projects in\n[VPC Service Controls](/vpc-service-controls/docs/supported-products#table_vm_manager)\nservice perimeters.\n\nOverview\n\nThe following services are available as part of the VM Manager suite:\n\n- [Patch](/compute/vm-manager/docs/patch): Use this service to apply on-demand and scheduled patches. You can also use Patch for patch compliance reporting in your environment.\n- [OS inventory management](/compute/vm-manager/docs/os-inventory/os-inventory-management): Use this service to collect and review operating system information.\n- [OS policies](/compute/vm-manager/docs/os-policies): Use this service to install, remove, and auto-update software packages.\n\n[](/static/compute/images/manage-os/vm-manager-arch.png) Figure 1. VM Manager architecture overview\n\nWhen you set up or enable VM Manager in your Google Cloud project,\nyou can access the full suite of VM Manager tools: Patch,\nOS policies, and OS inventory management.\n\nEnable VM Manager\n\nYou can set VM Manager to be automatically enabled or manually\nenabled. Automatic enablement applies to your entire project. Manual enablement\ncan be done per VM or for the entire project.\n\nIn summary, when you enable VM Manager, whether automatically\nor manually, the following setup takes place:\n\n- OS Config service API is enabled on the Google Cloud project.\n- The OS Config agent, running on each selected VM, is activated by setting\n the required [instance metadata](/compute/docs/manage-os#enable-metadata)\n values.\n\n | **Note:** OS Config is [preinstalled](/compute/docs/manage-os#check-install) on most VMs but is not activated until instance metadata is set.\n\nFor more information about manually enabling VM Manager,\nsee [Setup overview](/compute/docs/manage-os#overview).\n\nAutomatic enablement is done from the Google Cloud console.\n\nOS Config agent\n\nWhen VM Manager is enabled, the OS Config agent functions as follows\nfor each of the services:\n\n- For *Patch* , the OS Config agent uses OS system utilities (such as `yum`, `apt`, `rpm` or the Windows Update Agent) to retrieve patches or updates from the OS package or update source and apply them to the VM. For more information, see [How Patch works](/compute/vm-manager/docs/patch#how_os_patch_management_works).\n- For *OS policies* , the OS Config agent uses OS system utilities (such as `yum`, `apt`, `rpm` or the Windows Update Agent) to maintain the state for the VM that is specified in the OS policy. For more information, see [How OS policies work](/compute/vm-manager/docs/os-policies#how_os_configuration_management_works).\n- For *OS inventory management* , the OS Config agent collects [inventory data](/compute/vm-manager/docs/os-inventory/os-inventory-management#data-collected). This inventory data is then stored in the [instance metadata](/compute/docs/storing-retrieving-metadata) and in various log streams. This data can then be queried using the Google Cloud CLI. For more information, see [How OS inventory management works](/compute/vm-manager/docs/os-inventory/os-inventory-management#how_os_inventory_management_works).\n\nGoogle Cloud OS Config Service Agent\n\nSome Google Cloud services have\n[Google-managed service accounts](/iam/docs/service-account-types#google-managed)\nthat allow services to access your resources. These service accounts are\nsometimes known as *service agents* . For more information about service agents,\nsee [Service agents](/iam/docs/service-agents).\n\nVM Manager manages your VMs using a service agent that collects\ninformation about your VMs on your behalf. The email for this Google-managed\nservice agent is\n`service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-sa-osconfig.iam.gserviceaccount.com`.\nThis account uses the Cloud OS Config Service Agent role (`roles/osconfig.serviceAgent`).\n| **Note:** Google creates the service agent for VM Manager only when Patch uses its service to start a patch job and to filter out the VM data. OS policies does not use this service agent.\n\nYou can view your project's service agents and the roles granted to the service\nagents on the [IAM page of the Google Cloud console](https://console.cloud.google.com/iam-admin).\nHowever, if you've revoked the Cloud OS Config Service Agent role for the service agent,\nyou cannot view the service agent on the IAM page.\n\nOS packages and update source\n\nFor both Patch and OS policies, your VMs must be\nable to access package sources and repositories. For VMs in private networks,\nyou can set up [Private Google Access](/vpc/docs/configure-private-google-access).\n\nVM Manager and Terraform\n\nYou can use Terraform to extend the scope of VM Manager to multiple projects in\na Google Cloud organization. To learn how to create patch jobs and OS policy\nassignments by using Terraform and VM Manager, see the Terraform\nexamples and tutorials in the\n[OS Config GitHub repository](https://github.com/GoogleCloudPlatform/osconfig/tree/master/examples/Terraform).\n\nFor more information about Terraform configurations and its usage,\nreview the documentation for the following resources:\n\n- [OS patch deployment](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/os_config_patch_deployment)\n- [OS policy assignment](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/os_config_os_policy_assignment)\n\nFor a list of available resources to get started with using Terraform,\nsee [Using Terraform with Google Cloud](/docs/terraform).\n\nPricing\n\nFor pricing information, see [VM Manager pricing](/compute/vm-manager/pricing).\n\nWhat's next?\n\n- Learn about [OS inventory management](/compute/vm-manager/docs/os-inventory/os-inventory-management).\n- Learn about [Patch](/compute/vm-manager/docs/patch).\n- Learn about [OS policies](/compute/vm-manager/docs/os-policies)."]]
