GCP Associate Cloud Engineer Practice Question

Your security team must grant a freelance developer SSH access to a single Compute Engine VM for exactly 14 days. After that period the key must become invalid automatically, with no manual cleanup. Because multiple freelancers are onboarded every month, you also want to avoid editing project- or instance-level SSH key metadata each time. Which approach meets these requirements with the least operational effort?

Require the developer to connect through IAP TCP tunneling and manually remove the IAP TCP forwarding IAM role after 14 days.
Add the developer's public key to the VM's ssh-keys instance metadata with an expire-on timestamp set 14 days in the future.
Enable OS Login on the VM, grant the developer the Compute OS Login IAM role only on that VM, and have them upload their SSH public key with a 14-day TTL (for example, --ttl=1209600s) using gcloud compute os-login ssh-keys add.
Store the public key in Secret Manager and use a startup script on the VM to retrieve the key into ~/.ssh/authorized_keys; schedule a Cloud Scheduler job to disable the secret after 14 days.

Report Issue

Answer Description

Enabling OS Login offloads SSH authentication to IAM-managed user profiles, so you do not need to touch instance or project metadata for each new user. Grant the developer the roles/compute.osLogin role (or a higher role that includes it) on the target VM and instruct them to upload their public key with an explicit expiration:

  gcloud compute os-login ssh-keys add \
      --key-file=~/.ssh/id_rsa.pub \
      --ttl=1209600s   # 14 days in seconds

The key is stored in the developer's OS Login profile and automatically becomes unusable when the TTL elapses. Adding keys directly to instance metadata, managing keys via startup scripts and Secret Manager, or relying on manual removal of IAP roles either requires ongoing manual effort or adds unnecessary components, so they do not satisfy the automation and simplicity requirements.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.