gcloud

To remove a public SSH key from your account, do the following:

1. If you don't know which key you want to remove, run thegcloud compute os-login describe-profile commandto view all keys associated with your account:

   gcloud compute os-login describe-profile

2. Copy thefingerprint value of the key you want to delete.

3. Remove the key from your account using thegcloud compute os-login ssh-keys remove command:

   gcloud compute os-login ssh-keys remove --key=KEY

   ReplaceKEY with the public SSH key you want toremove, or the OS Login fingerprint for the key you want to remove.

REST

To remove a public SSH key from your account, do the following:

1. If you don't know which key you want to remove, use theusers.getLoginProfile methodto view all keys associated with your account:

   GET https://oslogin.googleapis.com/v1/users/ACCOUNT_EMAIL/loginProfile

   ReplaceACCOUNT_EMAIL with the email addressassociated with your account.

2. Copy thefingerprint value of the key you want to delete.

3. Remove the key from your account using theusers.sshPublicKeys.delete method:

   DELETE https://oslogin.googleapis.com/v1/users/ACCOUNT_EMAIL/sshPublicKeys/FINGERPRINT

   Replace the following:

   • ACCOUNT_EMAIL: the email address associated withyour account
   • FINGERPRINT: the SHA-256 fingerprint of the key toremove

Console

To remove a public SSH key from project metadata using theGoogle Cloud console, do the following:

1. In the Google Cloud console, go to theMetadata page.

   Go to Metadata

2. Click theSSH keys tab.

3. ClickeditEdit at the top ofthe page.

4. Navigate to the SSH key that you want to remove and click thedelete delete button next to theSSH key.

   Repeat this step for each SSH key that you want to remove.

5. ClickSave.

gcloud

To remove a public SSH key from project metadata using thegcloud CLI, do the following:

1. Rungcloud compute project-info describe command to get the metadata for the project:

   gcloud compute project-info describe

   The output is similar to the following:

   ...metadata:  ...- key: ssh-keys    value: |-      cloudysanfrancisco:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAu5kKQCPF      baklavainthebalkans:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQDx3FNVC8 google-ssh {"userName":"baklavainthebalkans","expireOn":"2021-06-14T16:59:03+0000"}...

2. Copy thessh-keys metadata value.

3. Create and open a new text file on your workstation.

4. In the file, paste the list of SSH keys that you just copied, then deleteany keys you want to remove from project metadata.

5. Save and close the file.

6. Run thegcloud compute project-info add-metadata commandto set the project-widessh-keys value:

   gcloud compute project-info add-metadata --metadata-from-file=ssh-keys=KEY_FILE

   ReplaceKEY_FILE with one of the following:

   • the path to the file you created in the previous step, if the projecthad existing SSH keys
   • the path to your new public SSH key file, if the project didn't haveexisting SSH keys

REST

To remove a public SSH key from project metadata using theCompute Engine API, do the following:

1. Use theprojects.getmethod to get thefingerprint andssh-keys values from metadata.

   GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID

   ReplacePROJECT_ID with your project ID.

   The response is similar to the following:

   ..."fingerprint": "utgYE_XWtE8=","items": [ {  "key": "ssh-keys",  "value": "cloudysanfrancisco:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAu5kKQCPF\nbaklavainthebalkans:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQDx3FNVC8 google-ssh {"userName":"baklavainthebalkans","expireOn":"2021-06-14T16:59:03+0000"}" }]...

2. Copy the list of SSH key values and delete the keys you want to remove.

3. Use theprojects.setCommonInstanceMetadatato remove the SSH keys.

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/setCommonInstanceMetadata{"items": [ {  "key": "ssh-keys",  "value": "EXISTING_SSH_KEYS" }]"fingerprint": "FINGERPRINT"}

   Replace the following:

   • PROJECT_ID: your project ID
   • EXISTING_SSH_KEYS: the list of the SSH keysyou want to keep
   • FINGERPRINT: the value of thefingerprintfrom the response of theprojects.get request

Console

To remove a public SSH key from instance metadata using theGoogle Cloud console, do the following:

1. In the Google Cloud console, go to theVM instances page.

   Go to VM instances

2. Click the name of the VM that you want to remove a key for.

3. ClickEdit.

4. InSSH Keys section, clickShow and edit. Thesection expands to show all of the instance-level public SSH keys.

5. Click thedelete delete button next to theSSH key that you want to remove.

   Repeat this step for each SSH key that you want to remove.

6. ClickSave.

gcloud

To remove a public SSH key from instance metadata using thegcloud CLI, do the following:

1. Rungcloud compute instances describe commandto get the metadata for the VM:

   gcloud compute instances describeVM_NAME

   ReplaceVM_NAME with the name of the VM for which you need toadd or remove public SSH keys.

   The output is similar to the following:

   ...metadata:...- key: ssh-keys value: |-   cloudysanfrancisco:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAu5kKQCPF   baklavainthebalkans:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQDx3FNVC8 google-ssh {"userName":"baklavainthebalkans","expireOn":"2021-06-14T16:59:03+0000"}...

2. Copy thessh-keys metadata value.

3. Create and open a new text file on your local workstation.

4. In the file, paste the list of SSH keys that you just copied, then removeany keys you want to delete.

5. Save and close the file.

6. Run thegcloud compute project-info add-metadata commandto set the project-widessh-keys value:

   gcloud compute instances add-metadataVM_NAME --metadata-from-file ssh-keys=KEY_FILE

   Replace the following:

   • VM_NAME: the VM you want to remove theSSH key for
   • KEY_FILE: the path to the file that containsthe list of all project SSH keys

REST

To remove a public SSH key from instance metadata using theCompute Engine API, do the following:

1. Use theinstances.getmethod to get thefingerprint andssh-keys values from metadata.

   GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/VM_NAME

   Replace the following:

   • PROJECT_ID: your project ID
   • ZONE: the zone of the VM you're adding an SSHkey for
   • VM_NAME: the VM you're adding an SSH key for

   The response is similar to the following:

   ..."fingerprint": "utgYE_XWtE8=","items": [{ "key": "ssh-keys", "value": "cloudysanfrancisco:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAu5kKQCPF\nbaklavainthebalkans:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQDx3FNVC8 google-ssh {"userName":"baklavainthebalkans","expireOn":"2021-06-14T16:59:03+0000"}"}]...

2. Copy the list of SSH key values and delete the keys you want to remove.

3. Use theinstances.setMetadatato remove the SSH keys.

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/VM_NAME/setMetadata{"items": [ {  "key": "ssh-keys",  "value": "EXISTING_SSH_KEYS }]"fingerprint": "FINGERPRINT"}

   Replace the following:

   • PROJECT_ID: your project ID
   • EXISTING_SSH_KEYS: the value of thessh-keyskey from the response of theprojects.get request
   • FINGERPRINT: the value of thefingerprintfrom the response of theinstances.get request

1. In the Google Cloud console, go to theCreate an instance page.

   Go to Create an instance

2. To block project SSH keys, do the following:

   1. In the navigation menu, clickSecurity.

   2. Expand theManage access section.

   3. To disable OS Login, clear theControl VM access through IAM permissions checkbox.

   4. Select theBlock project-wide SSH keys checkbox.

3. Optional: Specify other configuration options. For more information, seeConfiguration options during instance creation.

4. To create and start the instance, clickCreate.

gcloud

To create a VM and block it from accepting SSH keys stored in projectmetadata using the gcloud CLI, use thegcloud compute instances create command:

gcloud compute instances createVM_NAME \    --metadata block-project-ssh-keys=TRUE

ReplaceVM_NAME with the name of the new VM.

REST

To create a VM and block it from accepting SSH keys stored in projectmetadata using the Compute Engine, construct aPOST request to theinstances.insert method:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances

Replace the following:

• PROJECT_ID: the project ID
• ZONE: the zone of the VM

In the body of the request, provide usernames and public SSH keys in theitems property:

...{ "items": [    {     "key": "block-project-ssh-keys",     "value": TRUE    }   ]}...

Console

To block VMs from accepting connections from SSH keys stored in projectmetadata using the Google Cloud console, do the following:

1. In the Google Cloud console, go to theVM instances page.

   Go to VM instances

2. Click the name of the VM that you want to block project SSH keys for.

3. ClickEdit.

4. UnderSSH Keys, select theBlock project-wide SSH keys checkbox.

5. When you have finished editing the connection setting for SSH keys, clickSave.

gcloud

To block VMs from accepting connections from SSH keys stored in projectmetadata using the gcloud CLI, do the following:

Run thegcloud compute instances add-metadata command:

gcloud compute instances add-metadataVM_NAME --metadata block-project-ssh-keys=TRUE

ReplaceVM_NAME with the name of the VM for whichyou want to block project-wide public SSH keys.

REST

To block VMs from accepting connections from SSH keys stored in projectmetadata using the Compute Engine API, do the following:

1. Use theinstances.getmethod to get thefingerprint from metadata.

   GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/VM_NAME

   Replace the following:

   • PROJECT_ID: your project ID
   • ZONE: the zone of the VM you're adding an SSHkey for
   • VM_NAME: the VM you're adding an SSH key for

   The response is similar to the following:

   ..."fingerprint": "utgYE_XWtE8="...

2. Use theinstances.setMetadata methodto setblock-project-ssh-keys toTRUE:

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/VM_NAME/setMetadata{"items": [ {  "key": "block-project-ssh-keys",  "value": TRUE }]"fingerprint": "FINGERPRINT"}

   Replace the following:

   • PROJECT_ID is your project ID
   • ZONE is the zone where your instance is located
   • INSTANCE_NAME is the instance where you want toblock project-wide keys.
   • FINGERPRINT: the value of thefingerprintfrom the response of theinstances.get request.