Project-wide SSH keys are enabled in VM instances

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: ansible-gcp-project-wide-ssh-keys-are-enabled-in-vm-instances

Provider: GCP

Platform: Ansible

Severity: Medium

Category: Secret Management

Learn More

Description

VM instances should block project-wide SSH keys. This prevents SSH keys defined at the project level from granting access to individual instances, reducing the risk of unintended or persistent SSH access and lateral movement if project metadata or keys are compromised.

For Ansible resources using google.cloud.gcp_compute_instance or gcp_compute_instance, ensure the metadata.block-project-ssh-keys property is defined and set to true. Resources that omit the metadata map, omit the block-project-ssh-keys key, or set it to false are flagged.

Secure configuration example for an Ansible task:

- name: Create VM with project-wide SSH keys blocked
  google.cloud.gcp_compute_instance:
    name: my-instance
    machine_type: e2-medium
    metadata:
      block-project-ssh-keys: true

Compliant Code Examples

- name: ssh_keys_blocked
  google.cloud.gcp_compute_instance:
    name: ssh-keys-blocked-instance
    metadata:
      block-project-ssh-keys: yes
    zone: us-central1-a
    auth_kind: serviceaccount

Non-Compliant Code Examples

- name: ssh_keys_unblocked
  google.cloud.gcp_compute_instance:
    name: ssh-keys-unblocked-instance
    metadata:
      block-project-ssh-keys: no
    zone: us-central1-a
    auth_kind: serviceaccount
- name: ssh_keys_missing
  google.cloud.gcp_compute_instance:
    name: ssh-keys-missing-instance
    metadata:
      startup-script-url: gs:://graphite-playground/bootstrap.sh
      cost-center: '12345'
    zone: us-central1-a
    auth_kind: serviceaccount
- name: no_metadata
  google.cloud.gcp_compute_instance:
    name: no-metadata-instance
    zone: us-central1-a
    auth_kind: serviceaccount