Project-wide SSH keys are enabled in VM instances

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: ansible-gcp-project-wide-ssh-keys-are-enabled-in-vm-instances

Provider: GCP

Platform: Ansible

Severity: Medium

Category: Secret Management

Learn More

Description

VM instances should block project-wide SSH keys. This prevents SSH keys defined at the project level from granting access to individual instances, reducing the risk of unintended or persistent SSH access and lateral movement if project metadata or keys are compromised.

For Ansible resources using google.cloud.gcp_compute_instance or gcp_compute_instance, ensure the metadata.block-project-ssh-keys property is defined and set to true. Resources that omit the metadata map, omit the block-project-ssh-keys key, or set it to false are flagged.

Secure configuration example for an Ansible task:

- name: Create VM with project-wide SSH keys blocked
  google.cloud.gcp_compute_instance:
    name: my-instance
    machine_type: e2-medium
    metadata:
      block-project-ssh-keys: true

Compliant Code Examples

- name: ssh_keys_blocked
  google.cloud.gcp_compute_instance:
    name: ssh-keys-blocked-instance
    metadata:
      block-project-ssh-keys: yes
    zone: us-central1-a
    auth_kind: serviceaccount

Non-Compliant Code Examples

- name: ssh_keys_unblocked
  google.cloud.gcp_compute_instance:
    name: ssh-keys-unblocked-instance
    metadata:
      block-project-ssh-keys: no
    zone: us-central1-a
    auth_kind: serviceaccount
- name: ssh_keys_missing
  google.cloud.gcp_compute_instance:
    name: ssh-keys-missing-instance
    metadata:
      startup-script-url: gs:://graphite-playground/bootstrap.sh
      cost-center: '12345'
    zone: us-central1-a
    auth_kind: serviceaccount
- name: no_metadata
  google.cloud.gcp_compute_instance:
    name: no-metadata-instance
    zone: us-central1-a
    auth_kind: serviceaccount