An external consultant on your VPN with no Google account needs SSH access to a Linux Compute Engine VM. What is the proper way to grant access?

The correct method is to have the consultant generate an SSH key pair. They provide you with the public key, which you then add to the VM's metadata (either project-wide or instance-specific). The consultant then uses their private key to connect. This is a standard and secure way to grant SSH access to users without Google accounts. Using gcloud compute ssh with Identity-Aware Proxy requires a Google account. Connecting directly to a public IP with gcloud compute ssh would still require proper authentication, which in this scenario means an SSH key pair. Providing a private key to someone else is a severe security risk, as private keys should never be shared.