MEDIUM
Source
Trivy
ID
AVD-GCP-0036

Instances should not override the project setting for OS Login

OS Login automatically revokes the relevant SSH keys when an IAM user has their access revoked.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Enable OS Login at project level and remove instance-level overrides

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
resource "google_compute_instance" "default" {
  name         = "test"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-9"
    }
  }

  metadata = {
    enable-oslogin = "TRUE"
  }
}