2.1 Select the project and ARM64 zone

Run these commands on your workstation or in Cloud Shell. Replace the project, region, zone, network and subnet examples with approved values. Choose a network tag reserved for this VM so the IAP rule targets it narrowly.

export PROJECT_ID="your-gcp-project-id"
export REGION="your-region"
export ZONE="your-arm64-zone"
export NETWORK="your-approved-vpc"
export SUBNET="your-approved-subnet"
export VM_NAME="openepm-dev"
export ADDRESS_NAME="openepm-dev-ip"
export VM_TAG="openepm-dev"

gcloud services enable compute.googleapis.com iap.googleapis.com --project="$PROJECT_ID" &&
gcloud compute machine-types describe t2a-standard-4 --zone="$ZONE" --project="$PROJECT_ID" &&
gcloud compute networks subnets describe "$SUBNET" --region="$REGION" --project="$PROJECT_ID" &&
gcloud compute images describe-from-family ubuntu-2404-lts-arm64 --project=ubuntu-os-cloud +  --format='yaml(name,architecture,status)'

Check that the subnet belongs to NETWORK and the region matches the zone. Confirm that the image has architecture ARM64 and status READY. Copy its exact name into the next command, keeping the same shell for subsequent steps.

export BOOT_IMAGE="the-name-returned-by-the-image-query"

If quota, permissions or machine availability prevent the build, have the project administrator resolve the limit or select a compatible zone before reserving the address.