From Google Cloud Console

Go to the VM compute metadata page by visiting: https://console.cloud.google.com/compute/metadata.
Click 'Edit'.
Add a metadata entry where the key is 'enable-oslogin' and the value is 'TRUE'.
Click 'Save' to apply the changes.
For every instance that overrides the project setting, go to the 'VM Instances' page at https://console.cloud.google.com/compute/instances.
Click the name of the instance on which you want to remove the metadata value.
At the top of the instance details page, click 'Edit' to edit the instance settings.
Under 'Custom metadata', remove any entry with key 'enable-oslogin' and the value is 'FALSE'
At the bottom of the instance details page, click 'Save' to apply your changes to the instance.

From Google Cloud CLI

gcloud compute project-info add-metadata --metadata enable-oslogin=TRUE

gcloud compute instances remove-metadata --keys=enable-oslogin

Optionally, you can enable two factor authentication for OS login. For more information, see: https://cloud.google.com/compute/docs/oslogin/setup-two-factor-authentication.

ID	Name	CSP	Domain	Severity
AC_GCP_0275	Ensure multi-factor authentication is enabled for Google Compute Project Metadata	GCP	Security Best Practices	LOW
AC_GCP_0291	Ensure oslogin is enabled for a Project - google_compute_project_metadata	GCP	Security Best Practices	LOW

Tenable Cloud Security Policies Search