2. Provision Google Cloud
Run this stage from the workstation or Cloud Shell with the approved Google Cloud project. The VM, its boot disk and the regional address are chargeable resources. Keep the project, region, zone and instance variables in the same shell and record the resource owners.
- Select the project and zone and record the resolved Ubuntu ARM64 image name.
- Reserve the regional external address and keep it unattached until the firewall review.
- Create the VM on the approved subnet with an internal address only.
- Verify effective firewall rules and test IAP SSH before attaching the address for this example's outbound downloads.
Once the tunnel works and the intended address is attached, continue to host preparation. Leave the public gateway closed until its identity and TLS configuration is ready.
In this section
- 2.1 Select the project and ARM64 zoneVerify the project, subnet, machine type and exact ready ARM64 image before provisioning.
- 2.2 Reserve a static external IPReserve a regional address and leave it unattached until the access checks pass.
- 2.3 Create the ARM64 Ubuntu VMCreate the approved Ubuntu ARM64 instance on its internal address.
- 2.4 Restrict administrative SSHReview effective firewall policy and test IAP SSH before attaching the reserved address.