2.3 Create the ARM64 Ubuntu VM

Use the approved project, subnet, zone and exact image name from step 2.1. Review the subnet and tag with the network owner first. Create the VM with an internal IP and leave the reserved external address unattached.

gcloud compute instances create "$VM_NAME" \
  --project="$PROJECT_ID" --zone="$ZONE" --subnet="$SUBNET" \
  --machine-type="t2a-standard-4" \
  --image-project="ubuntu-os-cloud" --image="${BOOT_IMAGE:?Complete step 2.1 first}" \
  --boot-disk-type="pd-balanced" --boot-disk-size="100GB" \
  --no-address --tags="$VM_TAG" \
  --metadata="enable-oslogin=TRUE" \
  --no-service-account --no-scopes \
  --shielded-secure-boot --shielded-vtpm --shielded-integrity-monitoring &&
gcloud compute instances describe "$VM_NAME" --project="$PROJECT_ID" --zone="$ZONE" \
  --format='yaml(status,machineType,networkInterfaces,tags,shieldedInstanceConfig)'

Expect RUNNING, the chosen machine type, the approved subnet, a private networkIP, and no external accessConfigs. The example uses OS Login and needs no VM service account. If boot fails, have the project administrator verify image architecture and Secure Boot compatibility before proceeding.

Continue to step 2.4 with the VM still on its internal address.