Glossary term
OS Login
Compute Engine feature tying SSH access to IAM identities instead of metadata SSH keys. Enabled with enable-oslogin=TRUE; disabling it lets injected keys work.
OS Login makes SSH access to Compute Engine VMs depend on IAM: users get Linux accounts from their Google identity and need roles such as roles/compute.osLogin. It is enabled with the metadata key enable-oslogin=TRUE at instance or project level, and can be enforced with the compute.requireOsLogin organization policy.
When OS Login is enabled, SSH keys stored in metadata are ignored. Removing or changing enable-oslogin (or block-project-ssh-keys) therefore reactivates metadata keys, which is why attackers who inject an ssh-keys entry often switch OS Login off in the same call. Both changes are visible in the metadata delta of Admin Activity logs.
See GCP crypto mining and startup-script backdoors: detection.