为什么VM无法使用VPC网络，static内部IP，连接到谷歌云平台ZC6E195553E6C7AC8592C389ACB9878A050AZ中的SSH？

Question

Google Cloud Platform Compute Engine When I created the VM within the VPC network, I set up a static internal IP. The firewall allowed the personal computer IP. In this situation, the VM's SSH could not be reached.

Once logged in to the Google Cloud platform, metadata I generated using the keigen command to access the VM in a terminal in local environment. eg) ssh email ID@IP

Why can't I access that VM's SSH from the console on the Google Cloud platform?

Thank you for reading it. :)

Answer 1

If we read the following GCP documentation...https://cloud.google.com/solutions/connecting-securely#external

we find the following statement:

When instances do not have external IP addresses (including VMs that are backends for HTTPS and SSL proxy load balancers) they can only be reached by other instances on the network, Identity-Aware Proxy's TCP forwarding feature, or by using managed VPN gateway.

The key phrase to me is that they can only be reached... . It would thus appear that you can only reach a VM without a public IP using the recipes described in the article. If it were me, I'd consider actually giving the machine a public IP address and then following the recipes described in the article to only allow access to the machine through secured means. Google is promoting a story it called Beyond Corp which basically summarizes down to trust nothing. Every attempt to access any resource will be validated on a request by request basis and don't assume that lack of network access is enough to secure a resource. Instead, consider the notion that the VM can be publicly reachable but only authorized requests should be satisfied.