Compute Engine instances should all have OS Login enabled in the project

Checks that OS Login is enabled for all Compute Engine instances in the project. The control description says enabling OS login binds SSH certificates to IAM users and facilitates effective SSH certificate management.

Enabling OS login binds SSH certificates to IAM users and facilitates effective SSH certificate management.

What this control checks

Compute Engine instances in the project must have OS Login enabled.

Audit evidence

Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_instance_oslogin_enabled.

Framework-specific interpretation

SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...), CC6.2 (Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and...) and CC6.3 (The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets...).

NIST SP 800-53 Rev 5: Mapped to AC-2 (Account Management).

NIST Cybersecurity Framework v2.0: Mapped to ID.AM-01 (Inventories of hardware managed by the organization are maintained.) and PR.PS-01 (Configuration management practices are established and applied.).

Framework mappings

The clauses this control is mapped to in each framework.

SOC 2

CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
CC6.2 Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity
CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives

NIST SP 800-53 Rev 5