Creating a VM with OS Login

Written by

Updated at May 19, 2026

With OS Login, you can provide users and service accounts access to VMs relying solely on the Yandex Identity and Access Management mechanisms. There is no need to upload SSH keys to each new VM when creating it.

Tip

To create VMs with OS Login access and connect to such VMs, enable OS Login at the Yandex Cloud organization level first.

To connect to a virtual machine or Kubernetes node with OS Login access enabled, assign the following roles to the user or service account:

compute.osLogin or compute.osAdminLogin role.
resource-manager.auditor role or higher for the folder containing the VM instance or Kubernetes node.
compute.operator role for connecting via the Yandex Cloud CLI.

You can use either the CLI or a standard SSH client to connect to VMs with OS Login access enabled. The connection can be established using an SSH certificate or SSH key, which first needs to be added to the Yandex Identity Hub user's or service account's OS Login profile.

Note

We recommend creating a local user on the new VM and providing a separate SSH key for that user: this way you will still be able to connect to the VM via SSH even if you disable the OS Login access for it. You can create a local user and provide an SSH key for them using metadata:

For users added via metadata:

After enabling access to a VM via OS Login, the keys specified in user-data and ssh-keys are removed from the metadata.
After disabling access to a VM via OS Login, the removed keys are recreated.

To create a VM with OS Login:

Management console

CLI

Terraform

API

Enable access via OS Login at the organization level.
Create a VM from a pre-built image with OS Login access support. Such images are available on Yandex Cloud Marketplace.

When creating a VM, select Access under Access by OS Login. If this option is not available, the selected image does not support OS Login access.

To be able to connect to the VM via SSH without OS Login, update the VM settings and select Access under SSH key.

Enable access via OS Login at the organization level.
Create a VM from a pre-built image with OS Login access support.

When creating a VM, specify this parameter for access via OS Login:
```
--metadata enable-oslogin=true
```

Enable access via OS Login at the organization level.
Create a VM from a pre-built image with OS Login access support.

When creating a VM for the yandex_compute_instance resource, specify the following parameter in the metadata parameter section to enable access via OS Login:
```
metadata = {
  enable-oslogin = true
}
```

Enable access via OS Login at the organization level.
Create a VM using the create REST API method for the Instance resource from a public image with OS Login access support:

When creating the VM, provide enable-oslogin=true in the metadata field.

After the created VM changes its status to Running, you will be able to connect to it via OS Login.

Note

For service accounts, OS Login profiles are not created automatically. To connect to a VM or Kubernetes node on behalf of a service account, you need to manually create an OS Login profile.

Creating a VM with OS Login

Was the article helpful?