Enabling access via OS Login

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

1. View the description of the CLI command to enable OS Login access at the organization level:

   yc organization-manager oslogin update-settings --help
   

2. Get the ID of the required organization:

   yc organization-manager organization list
   

   Result:

   +----------------------+-------------------------+-------------------------+
   |          ID          |          NAME           |          TITLE          |
   +----------------------+-------------------------+-------------------------+
   | bpf1smsil5q0******** | sample-organization-1   | My organization         |
   | bpf2c65rqcl8******** | sample-organization-new | New organization        |
   +----------------------+-------------------------+-------------------------+
   

3. Enable access via OS Login for the selected organization:

   yc organization-manager oslogin update-settings \
     --organization-id <organization_ID> \
     --ssh-certificates-enabled \
     --ssh-user-keys-enabled \
     --allow-manage-own-keys
   

   Where:

   • --organization-id: Organization ID you got earlier.

   • --ssh-certificates-enabled: OS Login access using SSH certificates. This option allows you to connect to VMs or Kubernetes cluster nodes with an SSH certificate through the Yandex Cloud CLI or a standard SSH client.

     To disable this option, provide the false value in the --ssh-certificates-enabled=false parameter.

   • --ssh-user-keys-enabled: OS Login access using SSH keys. This option allows you to connect to VMs or Kubernetes cluster nodes via the Yandex Cloud CLI or a standard SSH client, using an SSH key stored in the OS Login profile of an organization user or service account.

     To disable this option, provide the false value in the --ssh-user-keys-enabled=false parameter.

   • --allow-manage-own-keys: Allow users to upload their own SSH keys. This option allows users themselves to upload public SSH keys to their OS Login profiles for connection to VMs and Kubernetes cluster nodes. To upload your own SSH keys, follow this guide.

     To disable this option, provide the false value in the --allow-manage-own-keys=false parameter.

     Note

     Only Yandex account, federated or local users assigned the organization-manager.osLogins.admin role or higher can upload SSH keys to service account OS Login profiles.

   Result:

   user_ssh_key_settings:
     enabled: true
     allow_manage_own_keys: true
   ssh_certificate_settings:
     enabled: true
   

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

1. In the configuration file, describe the properties of resources you want to create:

   resource "yandex_organizationmanager_os_login_settings" "my_os_login_settings" {
     organization_id = "<organization_ID>"
     ssh_certificate_settings {
       enabled = true
     }
     user_ssh_key_settings {
       enabled               = true
       allow_manage_own_keys = true
     }
   }
   

   Where:

   • organization_id: Organization ID. You can get the organization ID using the yc organization-manager organization list command in the Yandex Cloud CLI or through the Cloud Center interface.

   • ssh_certificate_settings: OS Login access using SSH certificates. This option allows you to connect to VMs or Kubernetes cluster nodes with an SSH certificate through the Yandex Cloud CLI or a standard SSH client. The enabled parameter may take either the true (option enabled) or false (option disabled) values.

   • user_ssh_key_settings: Section for managing access through user SSH keys.

     • enabled: OS Login access using SSH keys. This option allows you to connect to VMs or Kubernetes cluster nodes via the Yandex Cloud CLI or an SSH key stored in the profile of an organization user. It may take either the true (option enabled) or false (option disabled) values.

     • allow_manage_own_keys: Allow users to upload their own SSH keys. This option allows users themselves to upload public SSH keys to their OS Login profiles for connection to VMs and Kubernetes cluster nodes. To upload your own SSH keys, follow this guide. It may take either the true (option enabled) or false (option disabled) values.

     Note

     Only Yandex account, federated or local users assigned the organization-manager.osLogins.admin role or higher can upload SSH keys to service account OS Login profiles.

   For more information about the resources you can create with Terraform, see the relevant provider documentation.

2. Make sure the configuration files are correct.

   1. In the command line, navigate to the directory where you created the configuration file.

   2. Run a check using this command:

      terraform plan
      

   If the configuration description is correct, the terminal will display a list of the resources being created and their settings. If the configuration contains any errors, Terraform will point them out.

3. Deploy the cloud resources.

   1. If the configuration does not contain any errors, run this command:

      terraform apply
      

   2. Confirm creating the resources.

   The organization settings will then be changed. To make sure OS Login access is enabled, run this Yandex Cloud CLI command by specifying the organization ID:

   yc organization-manager oslogin get-settings --organization-id <organization_ID>
   

   Result:

   user_ssh_key_settings:
     enabled: true
     allow_manage_own_keys: true
   ssh_certificate_settings:
     enabled: true
   

Use the updateSettings REST API method for the OsLogin resource or the OsLoginService/UpdateSettings gRPC API call.