Question

A financial services company runs hundreds of Compute Engine VMs across many projects. Their security team requires that all SSH access to VMs be centrally auditable, tied to IAM identities, and that access can be revoked immediately when an employee leaves. Currently, engineers manage their own project-level and instance-level SSH metadata keys, which the security team cannot easily track. Which approach best meets these requirements with minimal ongoing operational overhead?

Accepted Answer

Enforce the constraints/compute.requireOsLogin organization policy to enable OS Login org-wide, and grant SSH access through IAM roles such as roles/compute.osLogin.

Answer

Rotate the project-wide SSH metadata keys weekly using a scheduled Cloud Function and store the keys in Secret Manager.

Answer

Require engineers to connect only through a single bastion host and distribute a shared SSH private key to authorized users.

Answer

Configure firewall rules to allow SSH only from the corporate IP range and enable VPC Flow Logs for auditing connections.