Creating a VM with OS Login
With OS Login, you can provide users and service accounts access to VMs relying solely on the Yandex Identity and Access Management mechanisms. There is no need to upload SSH keys to each new VM when creating it.
Tip
To create VMs with OS Login access and connect to such VMs, enable OS Login at the Yandex Cloud organization level first.
For connection to a virtual machine or Kubernetes node with OS Login access enabled, assign the compute.osLogin
or compute.osAdminLogin
role to the user or service account. When connecting using the Yandex Cloud CLI, you additionally need the compute.operator
role.
You can use either the YC CLI or a standard SSH client to connect to VMs with OS Login access enabled. To connect, you can use an SSH certificate or SSH key, which you first need to add to the OS Login profile of a Yandex Cloud Organization user or service account.
Note
We recommend creating a local user on the new VM and providing a separate SSH key for that user: this way you will still be able to connect to the VM via SSH even if you disable the OS Login access for it. You can create a local user and provide an SSH key for them using metadata:
For users added via metadata:
- After enabling access to a VM via OS Login, the keys specified in
user-data
andssh-keys
are removed from the metadata. - After disabling access to a VM via OS Login, the removed keys are recreated.
To create a VM with OS Login:
-
Enable access via OS Login at the organization level.
-
Create a VM from a pre-built image with OS Login access support. Such images are available on Yandex Cloud Marketplace.
When creating a VM, select Access by OS Login under Access. If this option is not available, the selected image does not support OS Login access.
To be able to connect to the VM via SSH without OS Login, update the VM settings and select SSH key under Access.
-
Enable access via OS Login at the organization level.
-
Create a VM from a pre-built image with OS Login access support.
When creating a VM, specify this parameter for access via OS Login:
--metadata enable-oslogin=true
-
Enable access via OS Login at the organization level.
-
Create a VM from a pre-built image with OS Login access support.
When creating a VM for the
yandex_compute_instance
resource, specify the following parameter in themetadata
parameter section to enable access via OS Login:metadata = { enable-oslogin = true }
-
Enable access via OS Login at the organization level.
-
Create a VM using the create REST API method for the Instance resource from a public image with OS Login access support:
When creating the VM, provide
enable-oslogin=true
in themetadata
field.
After the created VM changes its status to Running
, you will be able to connect to it via OS Login.