The Dress4Win security team has disabled external SSH access into production virtual machines (VMs) on Google Cloud Platform (GCP). The operations team needs to remotely manage the VMs, build and push Docker containers, and manage Google Cloud Storage objects. What can they do?

Granting the operations engineer access to Google Cloud Shell is the best solution because Cloud Shell provides a browser-based command-line interface directly connected to your GCP project. This allows engineers to manage VMs (using gcloud compute ssh), build and push Docker containers (using docker and gcloud artifacts docker), and manage Cloud Storage objects (using gsutil), all without requiring direct external SSH access to the VMs. Cloud Shell operates within the Google network, bypassing the disabled external SSH. Configuring a VPN would re-enable SSH access, which the security team explicitly disabled. Developing a new access request process for temporary SSH still relies on SSH, which is against the security policy. Building an API service is an overly complex and time-consuming solution for routine operational tasks that are already well-supported by existing GCP tools.