How to give access to single Compute Instance on GCP

Question

I've been attempting to understand this but have had no luck. Surprisingly challenging to accomplish compared to AWS.

I'm working on a Google Cloud Platform (GCP) project that includes several active Compute Instances and other services.

I must grant an outside development team root access to just one compute instance, but not to any other services.

When I choose the instance and add the user as Compute Admin (Full control of all Compute Engine resources) in the "Compute Engine" view, he is still unable to ssh into the instance.

Try #1:

Got a bug: "compute.instance is necessary.

receive approval."

I then went ahead and assigned that person a Role that contained that permission.

Try #2:

I received the error message "User does not have access to service account."

What on earth must be done in order to grant a role access to just one Compute Instance in GCP?

On AWS, there is a certain Role that can be granted access to a single resource, however in this instance, it appears that this is the case.

Concerns #2 Moreover, if the "Permissions" sidebar in the "Compute Engine" view doesn't actually grant any permissions, what is its purpose?

Thanks!

Answer 1

This link will show you how to set access controls for your Compute Engine resources as well as the many methods you may add new users to your project.

Reminder: Instead of adding the user to the project and giving them broad permissions, utilize the user's SSH keys to enable SSH access to virtual machine instances while preventing access to all APIs.

You could either add a user's public key to the project or add a user's public key to a single instance if you want to only allow users SSH access to VM instances. This is covered in the linked article.

Using the functionality "Managing Instance Access Using OS Login," you have more precise control over which

Users' ability to connect to your instances and their level of access.

Detailed information can be found in this document.

Hope this helps!

Join our GCP training online and learn about single compute instances in GCP.

Thanks!