External SSH is disabled for production VMs. Operations must manage VMs, build/push containers, and manage Cloud Storage objects. What can you grant them?

Granting access to Google Cloud Shell is the most appropriate solution. Cloud Shell provides a command-line environment directly within the browser, pre-configured with the Google Cloud SDK and other tools. This allows operations engineers to manage VMs (e.g., using gcloud compute ssh through the internal network, not external SSH), build/push containers (e.g., using Docker and gcloud builds submit), and manage Cloud Storage objects (e.g., using gsutil) without requiring external SSH access to the production VMs. Configuring a VPN to GCP to allow SSH access is incorrect because the premise states external SSH is disabled, implying a security policy against direct SSH even over a VPN. Implementing a temporary access process is also incorrect as it still relies on granting SSH, which is explicitly disabled. Having the dev team build an API service is overly complex and time-consuming for standard operational tasks that can be performed via existing GCP tools.