How to give GCP instance Compute OS Login

Question

I am trying to give access to one of the Team Member only Compute OS Login But I could not able to establish it.

How did I do?

Step 1

In the appropriate project under the IAM I added the user email and given Role for Compute OS Login after that.

Step 2

In terminal tried

# glcoud init 

After I have given all the necessary information I tried to log in with gcloud

# gcloud compute ssh sjkeerthi@test-instance -- -p 2020

No zone specified. Using zone [europe-west2-c] for instance: [test-instance].
Updating project ssh metadata...failed.                                                                                                              
Updating instance ssh metadata...failed.                                                                                                             
ERROR: (gcloud.compute.ssh) Could not add SSH key to instance metadata:
 - The user does not have access to service account '1096586xxxxx-compute@developer.gserviceaccount.com'.  User: 'sjkeerthi@xxxx.com'.  Ask a project owner to grant you the iam.serviceAccountActor role on the service account

Note :- Even I set the under the MetaData enable-oslogin=True

Answer 1

I think the following public documentation on Configuring OS Login roles on user accounts would be helpful. The error you got shows that your user is missing (iam.serviceAccountUser) role.

The user does not have access to service account '1096586xxxxx-compute@developer.gserviceaccount.com'. User: 'sjkeerthi@xxxx.com'. Ask a project owner to grant you the iam.serviceAccountActor role on the service account

As per the example, provided in the public document, you might grant instant access to your users with the following process:

Grant the necessary instance access roles to the user.

Users must have the following roles:

1. The iam.serviceAccountUser role.

One of the following login roles:

1. The compute.osLogin role, which does not grant administrator permissions
2. The compute.osAdminLogin role, which grants administrator permissions

Answer 2

You need the service Account Actor role to be added to the user account so it can act as a ServiceAccount "1096586xxxxx-compute@developer.gserviceaccount.com".

This role has been deprecated, Now you have to grant the Service Account User role and the Service Account Token Creator to the user account in IAM.

For more details, you can rely on the public documentation at this link.

If you are trying to ssh from a Google Compute Engine (GCE) instance to another GCE instance, make sure that the source instance has the Compute Engine scope set to read/write in its configuration settings so it can access other GCE instances.

Answer 3

You need to add the following roles to your IAM account, as shown here:

• Service Account User, roles/iam.serviceAccountUser
• Either of the following roles:
  • Compute OS Login, roles/compute.osLogin if you just want to log in as a regular user
  • Compute OS Admin Login, roles/compute.osAdminLogin if you want to be able to log in as an admin or have root privileges