gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To add a public SSH key to your account, use thegcloud compute os-login ssh-keys add command:

   gcloud compute os-login ssh-keys add \   --key-file=KEY_FILE_PATH \   --project=PROJECT \   --ttl=EXPIRE_TIME

   Replace the following:

   • KEY_FILE_PATH: the path to the public SSH keyon your workstation. The key must use thepublic-openssh format
   • PROJECT: Optional: a project where you intend touse your SSH key. Specify this field to use your SSH key in a projectoutside of your organization, or you are not a member of aCloud Identity organization

   • EXPIRE_TIME: Optional: the expiration time for theSSH key

     For example, if you specify30m the SSH key expires after 30 minutes.

     This flag uses the following units:

     • s for seconds
     • m for minutes
     • h for hours
     • d for days

Terraform

To add a public SSH key to your account, use thegoogle_client_openid_userinfo resource along with thegoogle_os_login_ssh_public_key resource.

data "google_client_openid_userinfo" "me" {}resource "google_os_login_ssh_public_key" "default" {  user = data.google_client_openid_userinfo.me.email  key  = file("id_rsa.pub") # path/to/ssl/id_rsa.pub}

REST

To add a public SSH key to your account, use the OS Login APIusers.importSshPublicKey method:

POST https://oslogin.googleapis.com/v1/users/ACCOUNT_EMAIL:importSshPublicKey{ "key": "SSH_KEY", "expirationTimeUsec": "EXPIRATION_TIMESTAMP"}

Replace the following:

• ACCOUNT_EMAIL: the email address associated withyour account
• SSH_KEY: the public key that you want to addto the account
• EXPIRATION_TIMESTAMP: the expiration time forthe key, in microseconds since epoch (1 second = 10⁶microseconds)

Console

To add a public SSH key to project metadata using theGoogle Cloud console, do the following:

1. In the Google Cloud console, go to theMetadata page.

   Go to Metadata

2. Click theSSH keys tab.

3. ClickEdit.

4. ClickAdd item.

5. In theSSH key field that opens, add your public SSH key. The keymust be in one of the following formats:

   • Format for a key without an expiration time:

     KEY_VALUEUSERNAME

   • Format for a key with an expiration time:

     KEY_VALUE google-ssh {"userName":"USERNAME","expireOn":"EXPIRE_TIME"}

   Replace the following:

   • KEY_VALUE: the public SSH key value
   • USERNAME: your username. For example,cloudysanfrancisco orcloudysanfrancisco_gmail_com.

     For Linux VMs, theUSERNAME can't beroot, unless you configure your VM to allow root login. For more information, seeConnect to Linux VMs as the root user.

     For Windows VMs that use Active Directory (AD), the username must be prepended with the AD domain, in the format ofDOMAIN\. For example, the usercloudysanfrancisco within thead.example.com AD has aUSERNAME ofexample\cloudysanfrancisco.

   • EXPIRE_TIME: the time the key expires, inISO 8601 format. For example:2021-12-04T20:12:00+0000

6. ClickSave.

gcloud

In the Google Cloud console, activate Cloud Shell.

Activate Cloud Shell

At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

1. If there are existing SSH keys in project metadata, you mustre-add them to project metadata every time you add a new SSH key using thegcloud CLI. If you don't re-add your existing keys,adding a new key erases the existing keys.

   To add a public SSH key to project metadata using the gcloud CLI,do the following:

   1. If your project already has project-wide public SSH keys, get them frommetadata and add them to a new file:

      1. Run thegcloud compute project-info describe commandto get the SSH keys for the project:

         gcloud compute project-info describe \ --format="value(commonInstanceMetadata[items][ssh-keys])"

         The output is similar to the following:

         username:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ... username:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ...

      2. Copy thessh-keys metadata value.

      3. Create and open a new text file on your workstation.

      4. In the file, paste the list of keys that you just copied.

      5. Add your new key at the end of the list, in one of the followingformats:

         • Format for a key without an expiration time:

           USERNAME:KEY_VALUE

         • Format for a key with an expiration time:

           USERNAME:KEY_VALUE google-ssh {"userName":"USERNAME","expireOn":"EXPIRE_TIME"}

         Replace the following:

         • KEY_VALUE: the public SSH key value
         • USERNAME: your username. For example,cloudysanfrancisco, orcloudysanfrancisco_gmail_com.

           For Linux VMs, theUSERNAME can't beroot, unless you configure your VM to allow root login. For more information, seeConnecting to instances as the root user.

           For Windows VMs that use Active Directory (AD), the username must be prepended with the AD domain, in the format ofDOMAIN\. For example, the usercloudysanfrancisco within thead.example.com AD has aUSERNAME ofexample\cloudysanfrancisco.

         • EXPIRE_TIME: the time the key expires, inISO 8601 format. For example:2021-12-04T20:12:00+0000

      6. Save and close the file.

   2. Run thegcloud compute project-info add-metadatacommand to set the project-widessh-keys value:

      gcloud compute project-info add-metadata --metadata-from-file=ssh-keys=KEY_FILE

      ReplaceKEY_FILE with one of the following:

      • The path to the file you created in the previous step, if the projecthad existing SSH keys
      • The path to your new public SSH key file, if the project didn't haveexisting SSH keys

Terraform

To add a public SSH key to your project metadata, use thegoogle_compute_project_metadata resource.

resource "google_compute_project_metadata" "default" {  metadata = {    ssh-keys = <<EOF      dev:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILg6UtHDNyMNAh0GjaytsJdrUxjtLy3APXqZfNZhvCeT dev      test:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILg6UtHDNyMNAh0GjaytsJdrUxjtLy3APXqZfNZhvCeT test    EOF  }}

REST

If there are existing SSH keys in project metadata, you mustre-add them to project metadata every time you add a new SSH key using thethe Compute Engine API. If you don't re-add your existing keys,adding a new key erases the existing keys.

To add a public SSH key to project metadata using the Compute Engine API,do the following:

1. Get thefingerprint andssh-keys values from metadata by using theprojects.get method

   GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID

   ReplacePROJECT_ID with your project ID.

   The response is similar to the following:

   ..."fingerprint": "utgYE_XWtE8=","items": [{ "key": "ssh-keys", "value": "cloudysanfrancisco:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAu5kKQCPF...\nbaklavainthebalkans:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQDx3FNVC8... google-ssh {"userName":"baklavainthebalkans","expireOn":"2021-06-14T16:59:03+0000"}"}]...

2. Add the newssh-keys value by using theprojects.setCommonInstanceMetadatamethod.

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/setCommonInstanceMetadata{"items": [ {  "key": "ssh-keys",  "value": "EXISTING_SSH_KEYS\nNEW_SSH_KEY" }]"fingerprint": "FINGERPRINT"}

   Replace the following:

   • PROJECT_ID: your project ID
   • EXISTING_SSH_KEYS: the value of thessh-keyskey from the response of theprojects.get request
   • FINGERPRINT: the value of thefingerprintfrom the response of theprojects.get request

   • NEW_SSH_KEY: the new SSH key, in one of thefollowing formats:

     • Format for a key without an expiration time:

       USERNAME:KEY_VALUE

     • Format for a key with an expiration time:

       USERNAME:KEY_VALUE google-ssh {"userName":"USERNAME","expireOn":"EXPIRE_TIME"}

     Replace the following:

     • KEY_VALUE: the public SSH key value
     • USERNAME: your username. For example,cloudysanfrancisco, orcloudysanfrancisco_gmail_com.

       For Linux VMs, theUSERNAME can't beroot, unless you configure your VM to allow root login. For more information, seeConnecting to instances as the root user.

       For Windows VMs that use Active Directory (AD), the username must be prepended with the AD domain, in the format ofDOMAIN\. For example, the usercloudysanfrancisco within thead.example.com AD has aUSERNAME ofexample\cloudysanfrancisco.

     • EXPIRE_TIME: the time the key expires, inISO 8601 format. For example:2021-12-04T20:12:00+0000

Console

To create an instance and add a public SSH key to instance metadata at thesame time using the Google Cloud console, do the following:

1. In the Google Cloud console, go to theCreate an instance page.

   Go to Create an instance

2. To add a public SSH key to instance metadata, do the following:

   1. In the navigation menu, clickSecurity.

   2. Expand theManage access section.

   3. To disable OS Login, clear theControl VM access through IAM permissions checkbox.

   4. If you want to allow public SSH keys in project metadata to access the instance, clear theBlock project-wide SSH keys checkbox.

   5. In theAdd manually generated SSH keys section, clickAdd item.

   6. Add your public key in the text box. The key must be in one of the following formats:

      • Format for a key without an expiration time:

        KEY_VALUEUSERNAME

      • Format for a key with an expiration time:

        KEY_VALUE google-ssh {"userName":"USERNAME","expireOn":"EXPIRE_TIME"}

      Replace the following:

      • KEY_VALUE: the public SSH key value
      • USERNAME: your username. For example,cloudysanfrancisco orcloudysanfrancisco_gmail_com.

        For Linux VMs, theUSERNAME can't beroot, unless you configure your VM to allow root login. For more information, seeConnect to Linux VMs as the root user.

        For Windows VMs that use Active Directory (AD), the username must be prepended with the AD domain, in the format ofDOMAIN\. For example, the usercloudysanfrancisco within thead.example.com AD has aUSERNAME ofexample\cloudysanfrancisco.

      • EXPIRE_TIME: the time the key expires, inISO 8601 format. For example:2021-12-04T20:12:00+0000

3. Optional: Specify other configuration options. For more information, seeConfiguration options during instance creation.

4. To create and start the instance, clickCreate.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To create a VM and add a public SSH key to instance metadata at the same timeusing the gcloud CLI, use thegcloud compute instances create command:

   gcloud compute instances createVM_NAME \   --metadata=ssh-keys=PUBLIC_KEY

   Replace the following:

   • VM_NAME: the name of the new VM

   • PUBLIC_KEY: your public SSH key, in one of thefollowing formats:

     • Format for a key without an expiration time:

       USERNAME:KEY_VALUE

     • Format for a key with an expiration time:

       USERNAME:KEY_VALUE google-ssh {"userName":"USERNAME","expireOn":"EXPIRE_TIME"}

     Replace the following:

     • KEY_VALUE: the public SSH key value
     • USERNAME: your username. For example,cloudysanfrancisco, orcloudysanfrancisco_gmail_com.

       For Linux VMs, theUSERNAME can't beroot, unless you configure your VM to allow root login. For more information, seeConnecting to instances as the root user.

       For Windows VMs that use Active Directory (AD), the username must be prepended with the AD domain, in the format ofDOMAIN\. For example, the usercloudysanfrancisco within thead.example.com AD has aUSERNAME ofexample\cloudysanfrancisco.

     • EXPIRE_TIME: the time the key expires, inISO 8601 format. For example:2021-12-04T20:12:00+0000

   You can add multiple SSH keys by using the--metadata-from-file=ssh-keys=FILE_PATH flag.In the file, add a list of usernames and public SSH keys in one of thepreceding formats.

Terraform

To add a public SSH key to your instance metadata, use thegoogle_compute_instance resource.

resource "google_compute_instance" "default" {  name         = "my-vm"  machine_type = "n1-standard-1"  zone         = "us-central1-a"  boot_disk {    initialize_params {      image = "ubuntu-1404-trusty-v20160627"    }  }  # Local SSD disk  scratch_disk {    interface = "SCSI"  }  network_interface {    network = "default"    access_config {}  }  metadata = {    "ssh-keys" = <<EOT      dev:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILg6UtHDNyMNAh0GjaytsJdrUxjtLy3APXqZfNZhvCeT dev      test:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILg6UtHDNyMNAh0GjaytsJdrUxjtLy3APXqZfNZhvCeT test     EOT  }}

REST

To create a VM and add a public SSH key to instance metadata at the sametime using the Compute Engine, construct aPOST request to theinstances.insert method:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances

Replace the following:

• PROJECT_ID: the project ID
• ZONE: the zone of the VM

In the body of the request, provide usernames and public SSH keys in theitems property:

...{ "items": [    {     "key": "ssh-keys",     "value": "PUBLIC_KEY"    }   ]}...

ReplacePUBLIC_KEY with your public key, in oneof the following formats:

• Format for a key without an expiration time:

  USERNAME:KEY_VALUE

• Format for a key with an expiration time:

  USERNAME:KEY_VALUE google-ssh {"userName":"USERNAME","expireOn":"EXPIRE_TIME"}

Replace the following:

• KEY_VALUE: the public SSH key value
• USERNAME: your username. For example,cloudysanfrancisco, orcloudysanfrancisco_gmail_com.

  For Linux VMs, theUSERNAME can't beroot, unless you configure your VM to allow root login. For more information, seeConnecting to instances as the root user.

  For Windows VMs that use Active Directory (AD), the username must be prepended with the AD domain, in the format ofDOMAIN\. For example, the usercloudysanfrancisco within thead.example.com AD has aUSERNAME ofexample\cloudysanfrancisco.

• EXPIRE_TIME: the time the key expires, inISO 8601 format. For example:2021-12-04T20:12:00+0000

You can add multiple SSH keys by adding\n between keys.

Console

To add a public SSH key to instance metadata using theGoogle Cloud console, do the following:

1. In the Google Cloud console, go to theVM instances page.

   Go to VM Instances

2. Click the name of the VM that you want to add an SSH key for.

3. ClickEdit.

4. UnderSSH Keys, clickAdd item.

5. Add your public key into the text box. The key must be in one of thefollowing formats:

   • Format for a key without an expiration time:

     KEY_VALUEUSERNAME

   • Format for a key with an expiration time:

     KEY_VALUE google-ssh {"userName":"USERNAME","expireOn":"EXPIRE_TIME"}

   Replace the following:

   • KEY_VALUE: the public SSH key value
   • USERNAME: your username. For example,cloudysanfrancisco orcloudysanfrancisco_gmail_com.

     For Linux VMs, theUSERNAME can't beroot, unless you configure your VM to allow root login. For more information, seeConnect to Linux VMs as the root user.

     For Windows VMs that use Active Directory (AD), the username must be prepended with the AD domain, in the format ofDOMAIN\. For example, the usercloudysanfrancisco within thead.example.com AD has aUSERNAME ofexample\cloudysanfrancisco.

   • EXPIRE_TIME: the time the key expires, inISO 8601 format. For example:2021-12-04T20:12:00+0000

6. ClickSave.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. If there are existing SSH keys in instance metadata, you must re-add them toinstance metadata every time you add a new SSH key using thegcloud CLI. If you don't re-add your existing keys, adding anew key erases the existing keys.

   To add a public SSH key to instance metadata using thegcloud CLI, do the following:

   1. If your VM already has instance-level public SSH keys, get them frommetadata and add them to a new file:

      1. Run thegcloud compute instances describe commandto get the metadata for the VM:

         gcloud compute instances describeVM_NAME

         ReplaceVM_NAME with the name of the VM for which youneed to add or remove public SSH keys.

         The output is similar to the following:

         ...metadata:...- key: ssh-keys value: |-   cloudysanfrancisco:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAu5kKQCPF...   baklavainthebalkans:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQDx3FNVC8... google-ssh {"userName":"baklavainthebalkans","expireOn":"2021-06-14T16:59:03+0000"}...

      2. Copy thessh-keys metadata value.

      3. Create and open a new text file on your workstation.

      4. In the file, paste the list of keys that you just copied.

      5. Add your new key at the end of the list, in one of the followingformats:

      • Format for a key without an expiration time:

        USERNAME:KEY_VALUE

      • Format for a key with an expiration time:

        USERNAME:KEY_VALUE google-ssh {"userName":"USERNAME","expireOn":"EXPIRE_TIME"}

      Replace the following:

      • KEY_VALUE: the public SSH key value
      • USERNAME: your username. For example,cloudysanfrancisco, orcloudysanfrancisco_gmail_com.

        For Linux VMs, theUSERNAME can't beroot, unless you configure your VM to allow root login. For more information, seeConnecting to instances as the root user.

        For Windows VMs that use Active Directory (AD), the username must be prepended with the AD domain, in the format ofDOMAIN\. For example, the usercloudysanfrancisco within thead.example.com AD has aUSERNAME ofexample\cloudysanfrancisco.

      • EXPIRE_TIME: the time the key expires, inISO 8601 format. For example:2021-12-04T20:12:00+0000
      1. Save and close the file.

   2. Run thegcloud compute instances add-metadata command to setthessh-keys value:

      gcloud compute instances add-metadataVM_NAME --metadata-from-file ssh-keys=KEY_FILE

      Replace the following:

      • VM_NAME: the VM you want to add theSSH key for
      • KEY_FILE with one of the following:
      • The path to the file you created in the previous step, if the VM hadexisting SSH keys
      • The path to your new public SSH key file, if the VM didn't haveexisting SSH keys

REST

If there are existing SSH keys in instance metadata, you must re-add them toinstance metadata every time you add a new SSH key using theCompute Engine API. If you don't re-add your existing keys, adding anew key erases the existing keys.

To add a public SSH key to instance metadata using theCompute Engine API, do the following:

1. Get thefingerprint andssh-keys values from metadata by using theinstances.getmethod.

   GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/VM_NAME

   Replace the following:

   • PROJECT_ID: your project ID
   • ZONE: the zone of the VM to add an SSHkey
   • VM_NAME: the VM you're adding an SSH key for

   The response is similar to the following:

   ..."fingerprint": "utgYE_XWtE8=","items": [{ "key": "ssh-keys",  "value": "cloudysanfrancisco:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAu5kKQCPF...\nbaklavainthebalkans:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQDx3FNVC8... google-ssh {"userName":"baklavainthebalkans","expireOn":"2021-06-14T16:59:03+0000"}"}]...

2. Add the newssh-keys value by using theinstances.setMetadatamethod.

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/VM_NAME/setMetadata{"items": [ {  "key": "ssh-keys",  "value": "EXISTING_SSH_KEYS\nNEW_SSH_KEY" }]"fingerprint": "FINGERPRINT"}

   Replace the following:

   • PROJECT_ID: your project ID
   • EXISTING_SSH_KEYS: the value of thessh-keyskey from the response of theinstances.get request
   • FINGERPRINT: thefingerprintfrom the response of theprojects.get request

   • NEW_SSH_KEY: the new SSH key, in one of thefollowing formats:

     • Format for a key without an expiration time:

       USERNAME:KEY_VALUE

     • Format for a key with an expiration time:

       USERNAME:KEY_VALUE google-ssh {"userName":"USERNAME","expireOn":"EXPIRE_TIME"}

     Replace the following:

     • KEY_VALUE: the public SSH key value
     • USERNAME: your username. For example,cloudysanfrancisco, orcloudysanfrancisco_gmail_com.

       For Linux VMs, theUSERNAME can't beroot, unless you configure your VM to allow root login. For more information, seeConnecting to instances as the root user.

       For Windows VMs that use Active Directory (AD), the username must be prepended with the AD domain, in the format ofDOMAIN\. For example, the usercloudysanfrancisco within thead.example.com AD has aUSERNAME ofexample\cloudysanfrancisco.

     • EXPIRE_TIME: the time the key expires, inISO 8601 format. For example:2021-12-04T20:12:00+0000