fix: block project-wide SSH keys (#897)

terraform-google-modules · Dec 6, 2022 · 07e9ab5 · 07e9ab5
1 parent 9285cd7
commit 07e9ab5
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/3-networks-hub-and-spoke/modules/transitivity/main.tf b/3-networks-hub-and-spoke/modules/transitivity/main.tf
@@ -43,13 +43,17 @@ module "templates" {
   network        = var.vpc_name
   project_id     = var.project_id
   region         = each.key
+
   service_account = {
     email  = module.service_account.email
     scopes = ["cloud-platform"]
   }
+
   metadata = {
-    user-data = templatefile("${path.module}/assets/gw.yaml", { commands = var.commands })
+    user-data              = templatefile("${path.module}/assets/gw.yaml", { commands = var.commands })
+    block-project-ssh-keys = "true"
   }
+
   source_image         = "cos-stable-93-16623-102-23"
   source_image_project = "cos-cloud"
   subnetwork           = var.gw_subnets[each.key]

diff --git a/5-app-infra/modules/env_base/main.tf b/5-app-infra/modules/env_base/main.tf
@@ -52,6 +52,10 @@ module "instance_template" {
   project_id   = local.env_project_id
   subnetwork   = local.subnetwork_self_link
 
+  metadata = {
+    block-project-ssh-keys = "true"
+  }
+
   service_account = {
     email  = google_service_account.compute_engine_service_account.email
     scopes = ["compute-rw"]