OSLogin is disabled in VM instance

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: ansible-gcp-oslogin-is-disabled-for-vm-instance

Provider: GCP

Platform: Ansible

Severity: Medium

Category: Insecure Configurations

Learn More

Description

OS Login should be enabled on Google Compute VM instances to centralize SSH access control via IAM and avoid unmanaged, long-lived SSH keys on individual instances. For Ansible-managed instances using the google.cloud.gcp_compute_instance or gcp_compute_instance modules, set the metadata.enable-oslogin property to true. Resources missing the enable-oslogin metadata key or with a value that does not evaluate to Ansible true are flagged.

Secure configuration example:

- name: create instance with OS Login enabled
  google.cloud.gcp_compute_instance:
    name: my-instance
    zone: us-central1-a
    metadata:
      enable-oslogin: true

Compliant Code Examples

- name: oslogin-enabled
  google.cloud.gcp_compute_instance:
    name: oslogin-enabled-instance
    metadata:
      enable-oslogin: yes
    zone: us-central1-a
    auth_kind: serviceaccount
- name: oslogin-missing
  google.cloud.gcp_compute_instance:
    name: oslogin-missing-instance
    metadata:
      startup-script-url: gs:://graphite-playground/bootstrap.sh
      cost-center: '12345'
    zone: us-central1-a
    auth_kind: serviceaccount

Non-Compliant Code Examples

- name: oslogin-disabled
  google.cloud.gcp_compute_instance:
    name: oslogin-disabled-instance
    metadata:
      enable-oslogin: no
    zone: us-central1-a
    auth_kind: serviceaccount