Instances should not override the project setting for OS Login
OS Login automatically revokes the relevant SSH keys when an IAM user has their access revoked.
Impact
Access via SSH key cannot be revoked automatically when an IAM user is removed.
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Enable OS Login at project level and remove instance-level overrides
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
resource "google_compute_instance" "default" {
name = "test"
machine_type = "e2-medium"
zone = "us-central1-a"
boot_disk {
initialize_params {
image = "debian-cloud/debian-9"
}
}
// Local SSD disk
scratch_disk {
interface = "SCSI"
}
metadata = {
}
}
|