GCP Terraform Misconfiguration: Compute Engine Access Control

A Terraform configuration sets up a Compute Engine instance without using Identity and Access Management (IAM) roles to manage SSH access.

The IAM-based access control reduces human errors and promotes efficiency. Enabling the OS Login permits the use of IAM roles to automate the lifecycle management of Linux accounts for accessing all Compute Engine instances in the same project or organization.

Example 1: The following example shows a Terraform configuration that disables the use of IAM roles to manage SSH access by setting enable-oslogin to false in the metadata argument.

resource "google_compute_instance" "compute-instance-demo" {
  ...
  metadata = {
    enable-oslogin = false
    ...
  }
  ...
}