Grant SSH access to Linux Compute Engine VMs for an operations partner that does not use Google Accounts. What should you do?

IAP TCP forwarding allows secure SSH access to VMs without public IP addresses, making it ideal for partners without Google Accounts. The Cloud IAP Tunnel User role grants permission to use this feature. Creating a VPC firewall rule requires the partner's network IP range, which might be dynamic or unknown, and exposes SSH directly to the internet. Cloud VPN is for site-to-site connectivity, not individual user access. Manually adding SSH keys to each VM is not scalable or easily manageable for multiple users or instances.