GCP projects should have OS Login 2FA enabled
OS Login Two-Factor Authentication (2FA) requires users to verify their identity with a second factor when connecting via SSH to VM instances. It provides an additional security layer beyond passwords or SSH keys.
Without 2FA enforcement, compromised credentials (stolen SSH keys or passwords) grant immediate access to VM instances. This single point of failure significantly increases the attack surface.
What this control checks
Checks whether the project has OS Login two-factor authentication turned on
Common pitfalls
Ensure enable-oslogin is also TRUE
Ensure enable-oslogin is also set to TRUE.
Audit evidence
Evidence that deployed resources meet this control: Prowler check compute_project_os_login_2fa_enabled (prowler gcp --checks compute_project_os_login_2fa_enabled).
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_compute_project_os_login_2fa_enabled - Prowler Check:
compute_project_os_login_2fa_enabled
Last reviewed: 2026-10-09