Are you talking about the `gcloud compute ssh` stuff? I wonder what magic google is using to grt public keys on boxes. I’d think there’d have to be some coordination with the machine image being run for this to work, so it wouldn’t be something Amazon could just turn on for everybody. You could probably roll your own using an SSH CA though.

They have daemons running to manage that and do stuff like add IP addresses when IP forwarding rules are added; https://github.com/GoogleCloudPlatform/compute-image-package...

Daemons running on user VMs? Or is ssh terminated in a bastion and forwarded somehow?

Edit: sorry didn’t read far enough and have now answered my own question. In VMs. So yea, Amazon could not duplicate without getting people to change AMIs or install some agent. Still seems like an SSH CA is a better option. Curious why google didn’t go that route. Maybe not an option when they built this?

I have successfully integrated Okta SSO to SSH via Hashicorp Vault, using it as a SSH CA to issue short-lived SSH certificates.