01 Run projects list command (Windows/macOS/Linux) using custom query filters to list the IDs of all the Google Cloud Platform (GCP) projects available in your Google Cloud account:
gcloud projects list
--format="table(projectId)"
02 The command output should return the requested GCP project IDs:
PROJECT_ID
cc-web-stack-project-123123
cc-ml-custom-project-112233
03 Run compute project-info describe command (Windows/macOS/Linux) using the ID of the GCP project that you want to examine as identifier parameter and custom query filters to describe the metadata items associated with the selected project:
gcloud compute project-info describe
--project cc-web-stack-project-123123
--format="json(commonInstanceMetadata.items)"
04 The command output should return the requested GCP project metadata items:
{
"commonInstanceMetadata": {
"items": [
{
"key": "enable-oslogin",
"value": "FALSE"
},
{
"key": "ssh-keys",
"value": "instance-admin:ssh-rsa ... \"expireOn\":\"2020-05-12T08:10:40+0000\"}"
}
]
}
}
If the
compute project-info describe command output does not return any metadata items with the key name set to
"enable-oslogin", or the
"enable-oslogin" item exists but the item value is set to
"FALSE", as shown in the output example above, the OS Login feature is not enabled at the Google Cloud Platform (GCP) project level.
05 Because VM instances can override GCP project settings, ensure there are no instances with "enable-oslogin" metadata key set to "FALSE" within the selected project. Run compute instances list command (Windows/macOS/Linux) using the ID of the verified GCP project as identifier parameter and custom filtering to describe the name and zone for each VM instance provisioned in the selected project:
gcloud compute instances list
--project cc-web-stack-project-123123
--format="table(name,zone)"
06 The command output should return the name(s) of the instance(s) within the selected GCP project:
NAME ZONE
cc-backend-vm-instance us-central1-a
cc-frontend-vm-instance us-central1-a
07 Run compute instances describe command (Windows/macOS/Linux) using the name and the zone of the instance that you want to examine as identifier parameter and custom filtering to describe the metadata items created for the selected virtual machine (VM) instance:
gcloud compute instances describe cc-backend-vm-instance
--zone us-central1-a
--format="json(metadata.items)"
08 The command output should return the requested VM instance metadata items:
{
"metadata": {
"items": [
{
"key": "enable-oslogin",
"value": "FALSE"
},
{
"key": "block-project-ssh-keys",
"value": "true"
},
{
"key": "ssh-keys",
"value": "web-instance-rsa-key:ssh-rsa ... web-instance-rsa-key"
}
]
}
}
If the command output does not return any metadata items with the key name set to
"enable-oslogin", then the VM will inherit the project-level settings. If the
"enable-oslogin" item exists but its value is set to
"FALSE", the OS Login feature is not enabled for the selected Google Compute Engine instance.
09 Repeat step no. 7 and 8 for each virtual machine instance provisioned within the selected project.
10 Repeat steps no. 3 – 7 for each GCP project deployed in your Google Cloud account.
Security