> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Disable Guest Attributes of Compute Engine Metadata

### More Info:

Ensure that "Disable Guest Attributes of Compute Engine Metadata" organization policy is enforced in order to disable Compute Engine API access to the guest attributes configured for the virtual machines instances that belong to your project, folder, or organization.

### Risk Level

Medium

### Address

Reliability, Security

### Compliance Standards

CBP

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of disabling the Guest Attributes of Compute Engine Metadata in GCP using the GCP console, follow these steps:

        1. Open the GCP Console and select the project where the misconfiguration exists.
        2. Navigate to the Compute Engine section from the left-hand menu.
        3. Click on the instance where the Guest Attributes of Compute Engine Metadata needs to be enabled.
        4. Click on the "Edit" button at the top of the page.
        5. Scroll down to the "Cloud Metadata" section and click on "Add item".
        6. In the "Key" field, enter "enable-guest-attributes".
        7. In the "Value" field, enter "TRUE".
        8. Click on the "Save" button at the bottom of the page to save the changes.

        After completing these steps, the Guest Attributes of Compute Engine Metadata will be enabled for the instance, and the misconfiguration will be remediated.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Disable Guest Attributes of Compute Engine Metadata" for GCP using GCP CLI, you can follow the below steps:

        Step 1: Open the Google Cloud Shell.

        Step 2: Run the following command to disable guest attributes of Compute Engine Metadata:

        ```
        gcloud compute instances add-metadata INSTANCE_NAME --metadata=google-compute-disable-guest-attributes=true
        ```

        Note: Replace INSTANCE\_NAME with the name of the instance for which you want to disable guest attributes of Compute Engine Metadata.

        Step 3: Verify that the guest attributes of Compute Engine Metadata have been disabled by running the following command:

        ```
        gcloud compute instances describe INSTANCE_NAME --format="get(metadata.items['google-compute-disable-guest-attributes'])"
        ```

        Note: Replace INSTANCE\_NAME with the name of the instance for which you have disabled guest attributes of Compute Engine Metadata.

        If the output of the above command is "true", then it means that the guest attributes of Compute Engine Metadata have been successfully disabled.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of disabling guest attributes of Compute Engine Metadata in GCP using Python, you can follow the below steps:

        Step 1: Set up the GCP SDK and authentication using the following command:

        ```
        gcloud auth login
        ```

        Step 2: Import the required libraries in Python:

        ```
        from googleapiclient import discovery
        from oauth2client.client import GoogleCredentials
        ```

        Step 3: Create a function to disable the guest attributes of Compute Engine Metadata:

        ```
        def disable_guest_attributes(project_id, zone):
            credentials = GoogleCredentials.get_application_default()
            service = discovery.build('compute', 'v1', credentials=credentials)
            metadata = service.instances().get(project=project_id, zone=zone, instance='INSTANCE_NAME').execute()['metadata']
            items = metadata['items']
            for item in items:
                if item['key'] == 'enable-guest-attributes':
                    item['value'] = 'FALSE'
            metadata['items'] = items
            service.instances().setMetadata(project=project_id, zone=zone, instance='INSTANCE_NAME', body=metadata).execute()
        ```

        Step 4: Replace the project\_id, zone, and INSTANCE\_NAME with your GCP project ID, zone, and instance name respectively.

        Step 5: Call the function to disable the guest attributes of Compute Engine Metadata:

        ```
        disable_guest_attributes('PROJECT_ID', 'ZONE')
        ```

        Note: Replace the PROJECT\_ID and ZONE with your GCP project ID and zone respectively.

        After executing the above code, the guest attributes of Compute Engine Metadata will be disabled for the specified instance.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>