Every Compute Engine instance in a business unit's folder should authorize administrator logins through IAM roles, not through public keys stored in instance or project metadata. What is the most centralized way to enforce this?
Show answer and explanation
Answer: D
The compute.requireOsLogin Organization Policy constraint, applied at the folder or above, makes OS Login mandatory for the VMs beneath it. Logins are then authorized by IAM roles such as the OS Login and OS Admin Login roles, and they are logged, which gives central control and an audit trail. Metadata-based keys stop granting access once enforcement applies. Because the control is set on the hierarchy, new projects inherit it and no per-VM work is needed.
Why the other options are wrong
- A. Closing port 22 blocks legitimate administration as well as attackers and does not say who may log in. It removes the access path instead of governing it through identity, so the requirement is not met.
- B. Owner is a basic role with sweeping rights across the folder, far beyond SSH access. Granting it contradicts least privilege and still leaves metadata keys in use.
- C. Rotation keeps the metadata key model in place, so keys still exist and can leak between rotations. It adds recurring work without moving authorization to IAM.