Creating a VM with OS Login
OS Login is used to provide users and service accounts with SSH access to VMs using IAM. To grant access to a VM that supports OS Login at the OS level, assign the following roles to a user:
To connect to a VM or Kubernetes node with enabled OS Login access via the YC CLI, assign the compute.osLogin or compute.osAdminLogin role as well as the compute.operator role to the user or service account running the YC CLI command.
To connect to a virtual machine or Kubernetes node with OS Login access enabled via a standard SSH client, assign the compute.osLogin or compute.osAdminLogin role to the connecting user or service account.
You can use either the YC CLI or a standard SSH client to connect to VMs with enabled OS Login access. To connect, you can use an SSH certificate or SSH key, which you first need to add to the OS Login profile of a Yandex Cloud Organization user or service account.
We recommend creating a local user on the new VM and providing a separate SSH key for that user: thus you will still be able to connect to the VM via SSH if you disable OS Login access for it. You can create a local user and provide an SSH key for them using metadata:
Tip
To create VMs with OS Login access and connect to such VMs, enable OS Login at the Yandex Cloud organization level first.
Note
For users added via metadata:
- After enabling access to a VM via OS Login, the keys specified in
user-dataandssh-keysare removed from the metadata. - After disabling access to a VM via OS Login, the removed keys are recreated.
To create a VM with OS Login:
-
Enable access via OS Login at the organization level.
-
Create a VM from a pre-built image with OS Login access support. Such images are available on Yandex Cloud Marketplace.
When creating a VM, select Access by OS Login under Access. If this option is not available, the selected image does not support OS Login access.
To be able to connect to the VM via SSH without OS Login, update the VM settings by disabling this option.
-
Enable access via OS Login at the organization level.
-
Create a VM from a pre-built image with OS Login access support.
When creating a VM, add a flag to enable access via OS Login:
--metadata enable-oslogin=true
-
Enable access via OS Login at the organization level.
-
Create a VM using the create REST API method for the Instance resource from a public image with OS Login access support:
When creating the VM, provide
enable-oslogin=truein themetadatafield.
After the created VM changes its status to Running, you will be able to connect to it via OS Login.