Where do GCE compute instance accounts come from when creating new instances?

Question

I created a brand new instance in a Google Compute Engine project, and I see in the logs where the instance creates new accounts-from-metadata. Some of the accounts created had been removed from the project permissions.

For example in project Permissions, I have:

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

The log entries from instance creation shows it's creating user accounts in the instance for users who had been removed from the project. It also doesn't show realuser3 who was added to the project permissions.

(instance-name) accounts-from-metadata: INFO Creating account (deleted1 user account)
(instance-name) accounts-from-metadata: INFO Creating account (realuser1 user account)
(instance-name) accounts-from-metadata: INFO Creating account (myownacct user account)
(instance-name) accounts-from-metadata: INFO Creating account user
(instance-name) accounts-from-metadata: INFO Creating account ubuntu
(instance-name) accounts-from-metadata: INFO Creating account (deleted2 user account)
(instance-name) accounts-from-metadata: INFO Creating account (previous google support user)

I expect to see realuser3, and I don't expect deleted users with no project permission to have accounts created on a fresh image.

Joe Beda Joe Beda · Accepted Answer · 2013-12-23T00:19:46

The accounts inside the VM are separate from the accounts that have permission to operate on the API.

The accounts in the VM come from the sshKeys metadata value that the VM sees. This is a union of VM specific metadata and the project metadata.

By default gcutil will prompt you to create a key and expand the sshKeys metadata value with that key and $USER. The easiest way to see and edit this is at the Cloud Console. There are more details on ssh'ing into the instance here.

Where do GCE compute instance accounts come from when creating new instances?

2 Answers