The default configuration of Google Compute Engine instances allows administrators to run all commands via sudo without specifying a password. This seems like a security weakness, because the theft of one SSH key belonging to an admin could allow unlimited access to every instance, and all data could be compromised. Requiring a password for sudo would provide a second level of security by preventing an attacker from obtaining root privileges. An attacker would also have to crack an admin's sudo password to access sensitive data or perform destructive acts.
It seems like it should be possible to configure sudo on each instance to require a password, but then each admin would then have to manually set a password on each instance. This approach would not scale well across many instances. Does Google Cloud Platform support any form of password management? If not, how can I require password for sudo in a way that scales well with many instances and multiple admins?