Control: 4.3 Ensure 'Block Project-wide SSH keys' is enabled for VM instances
Description
It is recommended to use Instance specific SSH key(s) instead of using common/shared project-wide SSH key(s) to access Instances.
Project-wide SSH keys are stored in Compute/Project-meta-data. Project wide SSH keys can be used to login into all the instances within project. Using project-wide SSH keys eases the SSH key management but if compromised, poses the security risk which can impact all the instances within project. It is recommended to use Instance specific SSH keys which can limit the attack surface if the SSH keys are compromised.
In addition, if OS Login is enabled, SSH keys in instance metadata are ignored, and therefore blocking project-wide SSH keys is not necessary.
Remediation
From Console
- Login to GCP VM Console.
- Click on the instance name to go to its VM instance details page.
- Navigate to
SSH Keyssection to check if Block project-wide SSH keys is checked or not. - If not, to block users with
project-wide SSHkeys from connecting to this instance, select Block project-wide SSH keys. - Click Save at the bottom of the page.
- Repeat steps for every impacted Instance.
Usage
Run the control in your terminal:
powerpipe control run gcp_compliance.control.cis_v120_4_3Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run gcp_compliance.control.cis_v120_4_3 --shareSQL
This control uses a named query:
compute_instance_block_project_wide_ssh_enabled