Managing Google Cloud Platform Project-Wide SSH Keys - Shopify

What this post added

This post details the development of SSH-Pruner, a Go application designed to manage project-wide SSH keys in Google Cloud Platform. It addresses the security risks of persistent SSH keys by implementing a 'just-in-time access' model. The solution iterates through GCP projects, identifies compute-enabled ones, and prunes SSH keys from project metadata that lack valid expiration dates. It distinguishes between Shopify's keys and Google's infrastructure keys, ensuring the latter are preserved. The application parses metadata line by line, adds only unexpired keys to a new metadata object, and overwrites the project metadata. Robust testing and a focus on Go best practices were emphasized during development.