Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Google Cloud feature
OS Login
Topic in 1 exam domain
- OS Login · Feature
- OS Login · Service
- OS login · Feature
Also called: OS Login API, OS Login profiles, OS Login service, OSLogin
A Compute Engine capability for managing SSH access to instances using IAM.
Where this appears on the exam
1 subdomain in 1 of 5 domains
~22% of exam
Related topics
FoundationsBuilding blocksThis topicWorks alongsideBuilds on theseBuilds on theseAppliedIAMServiceIdentity and Access ManagementServiceorganization policyConceptOrganization Policy ServiceServiceSecret ManagerServiceIAM rolesConceptservice accountConcept
OS LoginFeature
Identity-Aware ProxyServiceCloud IAMServiceApplication Default CredentialsFeatureCompute EngineServiceCloud StorageServiceBatchServiceCloud Storage bucketConceptPoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- Identity and Access Management works with OS Login From the official documentation: “OS Login lets you to manage access to instances using IAM.”
- OS Login is part of Compute Engine From the official documentation: “Require OS Login on Compute Engine Instances”
- Batch works with OS Login From the official documentation: “When you enable OS Login in a Batch job, OS Login configures a user account for you on the VMs that your job runs on.”
- Cloud IAM works with OS Login From the official documentation: “OS Login centralizes SSH key management with IAM and disables metadata-based SSH key configuration on all project instances.”
- IAM works with OS Login From the official documentation: “OS Login enables centralized SSH key management with IAM, and it disables metadata-based SSH key configuration on all instances in a project.”
- organization policy configures OS Login From the official documentation: “The following instructions detail how to enable OS Login using an organization policy in GKE.”
- Organization Policy Service configures OS Login From the official documentation: “For managing OS Login across multiple projects in an organization, consider enforcing OS Login by using an Organization Policy Service constraint (`compute.requireOsLogin`).”
- OS Login secures Compute Engine From the official documentation: “If you let developers access Compute Engine resources using SSH, configure OS Login with 2-step verification.”
- OS Login depends on IAM From the official documentation: “OS Login uses IAM to authorize login access.”
- OS Login depends on IAM roles From the official documentation: “Because OS Login uses IAM roles to authenticate users, it denies access to local accounts that are not associated with a Google identity and the required permissions.”
- Application Default Credentials works with Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Application Default Credentials works with Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
- Compute Engine works with service account From the official documentation: “A common method is to attach a service account to a resource like a Compute Engine instance.”
- Application Default Credentials secures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Application Default Credentials secures Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
- Application Default Credentials works with Secret Manager From the official documentation: “To authenticate to Secret Manager, set up Application Default Credentials.”
- Cloud Storage works with Compute Engine From the official documentation: “For example, you can create a service account that your Compute Engine instances use to access objects stored in Cloud Storage buckets.”
- Compute Engine works with Secret Manager From the official documentation: “To use Secret Manager with workloads running on Compute Engine or GKE, the underlying instance or node must have the `cloud-platform` OAuth scope.”
- Application Default Credentials secures IAM From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
- Cloud Storage depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Cloud Storage bucket is part of Cloud Storage From the official documentation: “Create a Google Cloud Storage bucket”
- IAM roles is part of Identity and Access Management From the official documentation: “IAM roles give the principals permissions to perform tasks on your App Topology resources.”
- Identity and Access Management secures Cloud Storage From the official documentation: “Cloud Storage uses Identity and Access Management (IAM) for authorization.”
- Identity and Access Management works with Identity-Aware Proxy From the official documentation: “IAP re-checks Identity and Access Management (IAM) authorization for all requests during valid sessions.”
- service account is part of Identity and Access Management From the official documentation: “Service accounts function as both principals and resources within IAM.”
- Application Default Credentials configures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see [Set up authentication for client libraries](/storage/docs/authentication#client-libs).”
- Application Default Credentials works with Identity and Access Management From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
- Application Default Credentials works with service account From the official documentation: “You can authenticate the service account using Application Default Credentials (ADC) or a service account key.”
- Batch depends on Application Default Credentials From the official documentation: “To authenticate to Batch, set up Application Default Credentials.”
- Batch depends on Compute Engine From the official documentation: “After you submit the job, Batch automatically queues, schedules, and executes the job on Compute Engine VMs.”
- Batch works with Compute Engine From the official documentation: “After you submit the job, Batch automatically queues, schedules, and executes the job on Compute Engine VMs.”
- Cloud Storage works with service account From the official documentation: “The service account can manage objects in the Cloud Storage bucket.”
- Compute Engine works with Identity-Aware Proxy From the official documentation: “Set up a Compute Engine instance with IAP.”
- IAM roles works with service account From the official documentation: “In this section, you designate the service account for the gateway proxies and assign them the correct IAM roles.”
- IAM roles configures service account From the official documentation: “2. [Grant the necessary Identity and Access Management roles](#grant-iam-roles) to your service account.”
- Identity and Access Management secures Compute Engine From the official documentation: “Compute Engine uses Identity and Access Management (IAM) for authorization.”
- Identity and Access Management secures Secret Manager From the official documentation: “Secret Manager uses Identity and Access Management (IAM) for authorization.”
- Identity-Aware Proxy works with service account From the official documentation: “Authenticate a service account to access resources secured by IAP.”
- Organization Policy Service configures service account From the official documentation: “To limit who can create service accounts, use the [Organization Policy Service](/resource-manager/docs/organization-policy/overview).”
- Secret Manager depends on Application Default Credentials From the official documentation: “To authenticate to Secret Manager, set up Application Default Credentials.”
- Secret Manager works with service account From the official documentation: “The service account can access the secret data.”
- service account depends on Secret Manager From the official documentation: “Make sure that the service account that AlloyDB Omni uses has the `secretmanager.secretAccessor` permission to read the secret from Secret Manager.”
- Application Default Credentials works with Batch From the official documentation: “To authenticate to Batch, set up Application Default Credentials.”
- Application Default Credentials secures Batch From the official documentation: “To authenticate to Batch, set up Application Default Credentials.”
- Application Default Credentials configures Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
- Application Default Credentials works with IAM From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
- Application Default Credentials secures Secret Manager From the official documentation: “To authenticate to Secret Manager, set up Application Default Credentials.”
- Application Default Credentials depends on service account From the official documentation: “If your `BidiProcessOrder` client runs in a secure environment that can be configured with service account credentials (such as Compute Engine, Google Kubernetes Engine, or your on-premise servers), it can use [Application Default Credentials…”
- Application Default Credentials is an alternative to service account From the official documentation: “There are two ways to obtain credentials for the agent to use: - Let the agent use a service account with private-key authentication - Let the agent use application default credentials (ADC).”
- Batch works with Cloud Storage bucket From the official documentation: “Create and submit a sample Batch job that runs a script that accesses an existing Cloud Storage bucket.”
- Batch is an alternative to Compute Engine From the official documentation: “3. Do you want to manage VMs or bare metal instances yourself? - **Yes**: [use Compute Engine](#compute-engine). - **No**: [use Batch](#batch).”
- Batch works with Secret Manager From the official documentation: “This document describes how to protect sensitive data that you want to specify for a Batch job by using Secret Manager secrets.”
- Batch depends on service account From the official documentation: “Each job requires a service account that allows the Batch service agent to create and access the resources required to run the job.”
- Cloud Storage works with IAM From the official documentation: “Use IAM and Cloud Storage Terraform resources to create a public Cloud Storage bucket.”
- Cloud Storage works with Identity and Access Management From the official documentation: “To learn how to use IAM with Cloud Storage, see [Using IAM Permissions](/storage/docs/access-control/using-iam-permissions).”
- Compute Engine depends on service account From the official documentation: “The Service Account is used by Compute Engine to access other Google APIs.”
- IAM depends on Application Default Credentials From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
- IAM configures Cloud Storage From the official documentation: “Apply IAM policies consistently across all relevant assets and resources in your AI and ML systems, including the following: - Cloud Storage buckets that contain sensitive data or model artifacts.”
- IAM configures Cloud Storage bucket From the official documentation: “IAM controls permissioning throughout Google Cloud and lets you grant permissions at the bucket and project levels.”
- IAM configures Secret Manager From the official documentation: “Configuring proper IAM permissions when using secret backends like Secret Manager so that the environment's service account has access to it.”
How learners score on this topic
Last updated