How to Standardize SSH Access Across Google Cloud Projects?

Why the Answer Is Correct

OS Login links SSH access on Compute Engine instances to Google Cloud IAM identities, so administrators grant or revoke access with IAM roles instead of distributing and rotating SSH keys on each VM. Applying the OS Login organization policy constraint (compute.requireOsLogin) gives the company a consistent control across projects and supports Cloud Audit Logs for access review. This removes the most manual steps: users no longer need project or instance metadata keys, and administrators do not need a service account to add keys to every VM. Option C's per-project phrasing is less elegant than setting the policy at the organization node, but organization policy is still the enforcement mechanism that makes OS Login a company-wide standard. It therefore best satisfies simplified management, audit compliance, and minimal manual effort.

Why the Other Options Are Wrong

A service account that adds SSH keys for all VMs still relies on key distribution and broad automation credentials, and it does not tie interactive SSH sessions to each user's IAM identity for clean auditing. Metadata SSH keys (B) are managed through project or instance metadata and must be maintained per scope; they also do not define sudo privileges, which are handled inside the instance or through OS Login IAM roles. Option D names OS Login, but domain two-factor authentication is a Google identity/Workspace control, not the project-level enforcement that guarantees OS Login is required across the company's Cloud projects. 2FA is a useful complementary safeguard, yet it does not replace the organization policy that enforces OS Login and eliminates manual key management.

Community Comment Notes

One commenter argues for D by listing the core requirements and correctly noting that “OS Login is Google's recommended solution for managing SSH access.” Their summary also rightly mentions IAM permissions, Google identities, centralized access control, and audit logging as OS Login benefits. The weak step is treating 2-Step Verification as the deciding feature: 2FA strengthens the Google account login, but the question asks for a company-wide SSH access standard across projects. That standard is enforced with the OS Login organization policy, which is why C remains the better answer even though D contains the right product name.