> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Instance level ssh only remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "SSH Keys Should Be Instance Specific" for GCP using GCP console, you can follow the below steps:

        1. Login to the GCP console and select the project where the instance is running.
        2. In the left navigation menu, select "Compute Engine" and then click on "VM instances".
        3. Select the instance for which you want to remediate the misconfiguration.
        4. Click on "Edit" button at the top of the page.
        5. Scroll down to the "SSH Keys" section and click on "Show and edit".
        6. Remove any public SSH keys that are not specific to the instance.
        7. Add new SSH keys that are specific to the instance by clicking on "Add item" and pasting the public key in the text box.
        8. Click on "Save" to save the changes.

        By following these steps, you have successfully remediated the misconfiguration "SSH Keys Should Be Instance Specific" for GCP using GCP console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of SSH keys not being instance-specific in GCP using GCP CLI, follow these steps:

        1. Open the Cloud Shell in the GCP console.

        2. Check the current SSH keys in your project using the following command:

        ```
        gcloud compute os-login ssh-keys list
        ```

        3. Identify the SSH keys that are not instance-specific and remove them using the following command:

        ```
        gcloud compute os-login ssh-keys remove --key-file=<path-to-key-file>
        ```

        4. Create a new instance-specific SSH key using the following command:

        ```
        ssh-keygen -t rsa -f ~/.ssh/<key-file-name> -C <comment>
        ```

        5. Add the new SSH key to your project using the following command:

        ```
        gcloud compute os-login ssh-keys add --key-file=<path-to-key-file>
        ```

        6. Create a new instance in GCP and specify the new SSH key as the metadata for the instance.

        7. Connect to the new instance using the new instance-specific SSH key.

        By following these steps, you can remediate the misconfiguration of SSH keys not being instance-specific in GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "SSH Keys Should Be Instance Specific" for GCP using Python, you can follow the below steps:

        1. First, you need to create a new SSH key pair for the instance. You can use the `paramiko` library in Python to generate an SSH key pair.

           ```
           import paramiko

           ssh = paramiko.SSHClient()
           ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
           ssh.connect('instance-ip-address', username='username', password='password')
           ssh.exec_command('ssh-keygen -t rsa')
           ```

        2. Once you have generated the SSH key pair, you need to add the public key to the instance's metadata. You can use the `google-auth` and `google-api-python-client` libraries in Python to interact with GCP APIs.

           ```
           from google.oauth2 import service_account
           from googleapiclient.discovery import build

           credentials = service_account.Credentials.from_service_account_file('path/to/credentials.json')

           compute = build('compute', 'v1', credentials=credentials)

           project_id = 'your-project-id'
           zone = 'instance-zone'
           instance_name = 'instance-name'

           instance = compute.instances().get(project=project_id, zone=zone, instance=instance_name).execute()

           metadata = instance['metadata']
           items = metadata.get('items', [])

           # Remove any existing SSH keys
           items = [item for item in items if item['key'] != 'ssh-keys']

           # Add the new SSH key
           ssh_key = 'ssh-rsa <public-key> instance-specific-key'
           items.append({'key': 'ssh-keys', 'value': ssh_key})

           # Update the instance metadata
           metadata['items'] = items
           compute.instances().setMetadata(project=project_id, zone=zone, instance=instance_name, body={'metadata': metadata}).execute()
           ```

        3. Finally, you can test the new SSH key by connecting to the instance using the private key.

           ```
           ssh.connect('instance-ip-address', username='username', key_filename='/path/to/private/key')
           ```

        By following these steps, you can remediate the misconfiguration "SSH Keys Should Be Instance Specific" for GCP using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_compute_instance" "INSTANCE_NAME" {
          name         = "INSTANCE_NAME"              # replace with your instance name
          machine_type = "MACHINE_TYPE"               # e.g. "e2-medium"
          zone         = "ZONE"                       # e.g. "us-central1-a"

          boot_disk {
            initialize_params {
              image = "BOOT_DISK_IMAGE"               # e.g. "debian-cloud/debian-12"
            }
          }

          network_interface {
            network = "NETWORK_SELF_LINK_OR_NAME"
          }

          # Ensure project-wide SSH keys are blocked on this instance
          metadata = {
            block-project-ssh-keys = "true"
            # add any other existing metadata keys here
          }
        }
        ```

        This change does not force replacement of the instance; Terraform will update instance metadata in place.

        For verification, `terraform plan` should show an in-place update to `google_compute_instance.INSTANCE_NAME` with `metadata.block-project-ssh-keys` changing from `false` (or null) to `"true"`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>