Compute Engine instances cannot have public IPs and there is no VPN. You must SSH to a specific VM from your office without violating the no-public-IP requirement. Which approach should you use?

IAP TCP forwarding allows you to establish a secure connection to your internal Compute Engine instances without assigning them public IP addresses. By enabling IAP TCP forwarding and granting the IAP-Secured Tunnel User role, you can use the gcloud command-line tool to tunnel SSH traffic through IAP's global network. This meets the requirement of no public IPs and no VPN. Cloud NAT is for outbound connections from private VMs to the internet, not for inbound SSH access. A TCP Proxy Load Balancer distributes traffic to backend instances, but it doesn't provide a secure tunnel for SSH to private instances without public IPs. A bastion host would require a VM with a public IP, which violates the problem's constraint.