Set up VM Manager

On Compute Engine you can manage the operating systems that are running on your virtual machines (VMs) by using VM Manager.

You can enable VM Manager for individual VMs, or for a project, or for all projects in a folder or organization. To review the steps needed to set up your VMs to use VM Manager, see Setup overview.

After setting up VM Manager, you can view audit logs for API operations performed with the OS Config API, see Viewing VM Manager audit logs.

Before you begin

Supported operating systems

For the full list of operating system versions that support VM Manager, see Operating system details. If the OS config agent is not available for a particular operating system, you cannot enable VM Manager for a VM that runs this operating system.

Enable the OS Config service API

You can enable the OS Config API for your Google Cloud projects by using one of the following methods:

Required roles

To get the permission that you need to enable the API, ask your administrator to grant you the Service Usage Admin (roles/serviceusage.serviceUsageAdmin) IAM role on your project. For more information about granting roles, see Manage access to projects, folders, and organizations.

This predefined role contains the serviceusage.services.enable permission, which is required to enable the API.

You might also be able to get this permission with custom roles or other predefined roles.

Enable OS Config API for a single project

In your Google Cloud project, enable the OS Config API.

Console

  1. In the Google Cloud console, select the project for which you want to enable the API.
  2. Go to the OS Config API page.

    Go to OS Config API

  3. Click Enable.

gcloud

To enable the API, run the following command:

gcloud services enable osconfig.googleapis.com --project=PROJECT_ID

Replace PROJECT_ID with your project ID.

Enable OS Config API for multiple projects

To enable the OS Config API (VM Manager API) for all of the projects in an organization or folder, use hierarchical service activation. Because this feature automatically enables a service for all existing and new projects within your Google Cloud resource hierarchy, you don't need to manually enable the service for each project.

For more information about hierarchical service activation, see Hierarchical service activation overview.

Required roles

To get the permissions that you need to manage service enablement, ask your administrator to grant you the Service Usage Admin (roles/serviceusage.serviceUsageAdmin) IAM role on your target resource. For more information about granting roles, see Manage access to projects, folders, and organizations.

This predefined role contains the permissions required to manage service enablement. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to manage service enablement:

You might also be able to get these permissions with custom roles or other predefined roles.

Folder

To enable OS Config API for all projects in a folder, run the following command:

gcloud beta services enable osconfig.googleapis.com \
    --folder=FOLDER_ID

Replace FOLDER_ID with your folder ID.

Organization

To enable OS Config API for all projects in an organization, run the following command:

gcloud beta services enable osconfig.googleapis.com \
    --organization=ORGANIZATION_ID

Replace ORGANIZATION_ID with your organization ID.

Set the VM Manager metadata by using an organization policy

You can automatically set the VM Manager metadata for all new VMs in your organization, folder, or project by using the Require OS Config organization policy.

When the Require OS Config boolean constraint is set up, the following conditions are applied:

When the OS Config organization policy is enabled, you can still use the osconfig-disabled-features metadata to disable one or more VM Manager features.

Enable OS Config organization policy