[MUSIC PLAYING]
SPEAKER: OS Login is a Compute Engine offering
that provides a way to manage SSH access to Linux
virtual machine instances using IAM roles.
When OS Login is enabled, a Linux user account
is directly tied to a user's Google identity.
This means that a user has a specific username and UID
in all OS Login VMs and their project or organization.
With OS Login, you can also restrict root access.
You can enable OS Login for individual VMs
or for all VMs in your project.
To enable OS Login for a specific VM,
go to the Compute Engine VM Instances page
and select your instance.
Start editing the instance and navigate to the Custom Metadata
section.
You want to add the key "enable-oslogin"
and set the value to True.
Then click Save.
OS Login is now enabled on this instance.
And only users with the appropriate IAM roles
can connect to the VM using SSH.
Alternatively, you can enable OS Login for all the instances
in your project by navigating to the Compute Engine Metadata
page and adding "enable-oslogin" with the value True.
Once this metadata key is added, OS Login
is enabled on all Linux VMs in the project.
You can disable OS Login on a specific instance by adding
the metadata "enable-oslogin" to false at the instance level.
You can also enable OS Login when
creating a VM in the advanced security options.
We will go over how to do this in a later example.
To grant a user permission to connect
to VMs that have OS Login enabled,
the user must have the required OS Login IAM roles.
Let's take a closer look at these roles.
Compute OS Admin Login allows the user
to SSH into the Instance and Run Commands as an administrator,
while Compute OS Login allows them to SSH
without administrative access.
The IAM service account user role
allows a user to run operations as a service account.
This is a necessary permission to log in
to a VM that is associated with the service account.
You can grant the Compute OS Login roles
at the instance level or at the project level
so they apply to all resources inside your project.
The service account user role can be granted on the project
or on individual service accounts.
In scenarios where users outside your organization
require access to your VMs, your organization administrator
must grant the Compute OS Login external user role
to those users at the organization level.
Let's run through an example.
We will start by creating a Compute Engine instance.
We are going to leave all the fields as defaults.
Scroll down and expand to the Security section.
Here you can see the Manage Access
section and the option Control VM Access
through IAM Permissions.
This will ensure that our newly created VM
will have OS Login enabled.
Let's return to SSH into the VM as a user
without the Compute Admin role.
And it's unsuccessful.
This is expected because we have not yet
given the necessary permissions to this user account.
Let's go ahead and grant the appropriate IAM roles
to my user account.
In this scenario, we would like this user
to be able to SSH into the VM but not on any commands
as the root account.
Therefore, we need to grant this user the Compute OS Login role.
Now let's try to SSH once again.
Wait a few seconds.
And we are able to SSH into the VM successfully.
In summary, OS Login can simplify SSH access management
to your Compute Engine instances by using IAM roles.
When granting these roles, always
keep in mind the security best practice of least privilege.
And set your permissions accordingly.
[MUSIC PLAYING]