Set up VM Manager
Stay organized with collections
Save and categorize content based on your preferences.
On Compute Engine you can manage the operating systems that are running on
your virtual machines (VMs) by using
VM Manager.
You can enable VM Manager for individual VMs, or for a project,
or for all projects in a folder or organization. To review the steps needed to
set up your VMs to use VM Manager, see Setup overview.
After setting up VM Manager, you can view audit logs for API operations
performed with the OS Config API, see
Viewing VM Manager audit logs.
If you haven't already, set up authentication.
Authentication verifies your identity for access to Google Cloud services and APIs. To run
code or samples from a local development environment, you can authenticate to
Compute Engine by selecting one of the following options:
Select the tab for how you plan to use the samples on this page:
Console
When you use the Google Cloud console to access Google Cloud services and
APIs, you don't need to set up authentication.
gcloud
Install the Google Cloud CLI.
After installation,
initialize the Google Cloud CLI by running the following command:
For the full list of operating system versions that support
VM Manager, see
Operating system details. If the
OS config agent is not available for a particular operating system, you cannot
enable VM Manager for a VM that runs this operating system.
Enable the OS Config service API
You can enable the OS Config API for your Google Cloud projects by using one of the following methods:
To enable the OS Config API (VM Manager API) for all of the projects in an organization or folder, use hierarchical service activation. Because this feature automatically enables a service for all existing and new projects within your Google Cloud resource hierarchy, you don't need to manually enable the
service for each project.
To get the permissions that
you need to manage service enablement,
ask your administrator to grant you the
Service Usage Admin (roles/serviceusage.serviceUsageAdmin) IAM role on your target resource.
For more information about granting roles, see Manage access to projects, folders, and organizations.
This predefined role contains
the permissions required to manage service enablement. To see the exact permissions that are
required, expand the Required permissions section:
Required permissions
The following permissions are required to manage service enablement:
Set the VM Manager metadata by using an organization policy
You can automatically set the VM Manager metadata for all new VMs in your
organization, folder, or project by using the Require OS Config organization policy.
When the Require OS Config boolean constraint is set up, the following
conditions are applied:
enable-osconfig=TRUE is included in the project metadata for all new
projects.
Requests that set enable-osconfig to FALSE in instance or project
metadata are rejected, for new and existing VMs and projects.
This organization policy does not change the enable-osconfig metadata value to TRUE
for VMs or for the projects that were created before enabling the policy.
If you want to enable VM Manager on those VMs or projects, we
recommend that you update the metadata. For more information, see Set the metadata values.
When the OS Config organization policy is enabled, you can still use the
osconfig-disabled-features metadata to disable one or more VM Manager features.
Enable OS Config organization policy
Permissions required for this task
To perform this task, you must have the following
permissions:
To enable the OS Config policy, you can set the Require OS Config constraint on
the entire organization, folders, or specific projects by using either the
Google Cloud console or the Google Cloud CLI.
To enable VM Manager in your project, you have two options:
Automatic enablement: applies to your entire Google Cloud project. You complete
automatic enablement from the Google Cloud console. You might still need
to manually complete some steps.
Manual enablement: can be done per VM or for the entire Google Cloud project.
The OS Config agent is installed by default on CentOS, Container-Optimized OS (COS),
Debian, Red Hat Enterprise Linux (RHEL), Rocky Linux, SLES, Ubuntu, and
Windows Server images that have a build date of v20200114 or later.
For information about the versions of operating systems with the
OS Config agent installed, see
Operating system details.
These agents run idly until you enable the agent metadata,
and enable the service API.
Verify that the startup script completes. To verify whether the startup
script completes, review the
logs or check the
serial console.
Set the metadata values
You can either set instance metadata on each VM or project metadata that applies
to all VMs in your project.
On your Google Cloud project or VM, set the enable-osconfig metadata value
to TRUE. Setting the enable-osconfig metadata value to TRUE enables the
following:
Patch
OS policies
OS inventory management
For the earlier version of OS inventory management, you must also
set the enable-guest-attributes metadata value to TRUE.
If both metadata values are not set, the dashboard shows
no data for the VM.
This is not needed for the later version. For information
about the two OS inventory management versions, see
OS inventory management versions.
If you use an HTTP proxy for your VMs, run the following commands to set the
http_proxy and https_proxy environment variables. To allow the OS Config
agent to access the local metadata server, you must configure the no_proxy
environment variable to exclude the metadata server (169.254.169.254 and
fd20:ce::254).
Google recommends that you exclude *.googleapis.com by adding the
no_proxy environment variable to avoid connection issues from the OS Config
agent. If you want to connect only specific VMs to the OS Config agent,
prefix the zone the VMs are in, and use the format [zone-name]-osconfig.googleapis.com.
For example, us-central1-f-osconfig.googleapis.com.
Disable features that you don't need
For features that you might not need, you can disable them by
setting the following metadata values:
osconfig-disabled-features=FEATURE1,FEATURE2.
Replace FEATURE1,FEATURE2 with any of
the following values:
OS inventory management: osinventory
Patch and OS policies: tasks
OS guest policies (beta): guestpolicies
Use one of the following methods to disable the metadata values.
If VM Manager isn't enabled in your project and you install
Ops Agent during VM creation,
VM Manager is enabled in the limited mode. In this mode,
VM Manager offers a subset of features for unlimited
number of VMs at no cost. For example, you can view the OS policy assignments for your
VMs on the OS policies page, but you cannot create or edit OS policy
assignments.
To enable all VM Manager features for these VMs with Ops Agent
installed, do the following:
Disabling the OS Config agent does not affect the behavior of your VM. You can
disable the agent the same way you stop other services of the operating system.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2026-06-09 UTC."],[],[]]