title: Can't figure out OS Login IAM permissions
body: <p>Can someone please help me understand which IAM permission I am still missing?</p>
  
  <p>I'm trying to enable <a href="https://cloud.google.com/compute/docs/oslogin" rel="nofollow noreferrer"><code>OS Login</code></a> on a single Compute VM, and have added <code>enable-oslogin: TRUE</code>. When I SSH through the UI, I see this error message:</p>
  
  <p><a href="https://i.stack.imgur.com/uZZxQ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/uZZxQ.png" alt="Error"></a></p>
  
  <p><a href="https://cloud.google.com/compute/docs/instances/managing-instance-access#enable_oslogin" rel="nofollow noreferrer">The instructions</a> say:</p>
  
  <blockquote>
    <p>roles/iam.serviceAccountUser </p>
  </blockquote>
  
  <p><strong>AND</strong> </p>
  
  <blockquote>
    <p>roles/compute.osLogin <strong>OR</strong> roles/compute.osAdminLogin</p>
  </blockquote>
  
  <p><strong>My IAM permissions:</strong>
  <a href="https://i.stack.imgur.com/qyZoj.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/qyZoj.png" alt="IAM permission"></a></p>