2.4 Restrict administrative SSH

Use IAP TCP forwarding and OS Login for administrative SSH while the VM has only its internal address. Have the project administrator grant roles/iap.tunnelResourceAccessor for the intended instance and the appropriate OS Login access. The operator who installs Docker needs administrative OS Login access.

Review effective firewall rules

If the network owner confirms that an appropriate IAP allow rule is missing, have them create this targeted rule. Otherwise reuse the approved existing rule.

gcloud compute firewall-rules create "${VM_TAG}-allow-iap-ssh" \
  --project="$PROJECT_ID" --network="$NETWORK" --direction=INGRESS --action=ALLOW \
  --rules=tcp:22 --source-ranges=35.235.240.0/20 --target-tags="$VM_TAG"

Inspect rules and policies that actually apply to the VM's interface.

gcloud compute instances network-interfaces get-effective-firewalls "$VM_NAME" \
  --project="$PROJECT_ID" --zone="$ZONE" --network-interface=nic0

Confirm the intended IAP source can reach TCP 22 and that the policy denies direct public SSH and ingress to database and backend listener ports. A broad inherited allow rule can still admit direct traffic. If an unexpected rule applies, or you cannot inspect the effective rules, keep the VM internal and have the network owner resolve it.

Test the tunnel, then attach the reserved address

After the firewall review passes, run this from the workstation or Cloud Shell. The test opens a short IAP session. A failed test stops the sequence before the address attachment.

gcloud compute ssh "$VM_NAME" --project="$PROJECT_ID" --zone="$ZONE" \
  --tunnel-through-iap --command=true &&
gcloud compute instances add-access-config "$VM_NAME" --project="$PROJECT_ID" --zone="$ZONE" \
  --network-interface=nic0 --address="${OPEN_EPM_IP:?Complete step 2.2 first}" --network-tier=PREMIUM &&
gcloud compute instances describe "$VM_NAME" --project="$PROJECT_ID" --zone="$ZONE" \
  --format='value(networkInterfaces[0].accessConfigs[0].natIP)'

The last command should return the address stored in OPEN_EPM_IP. If attachment reports an existing access config, inspect the current address and confirm it is the intended reservation before proceeding. Use IAP again when you connect to prepare the host. Keep public ingress closed until an authenticated HTTPS gateway is ready.