You need a particular VM to always egress the internet using a specific external IP address. Which approach guarantees that behavior?

Assigning a public external IP directly to a VM's network interface ensures that all egress traffic from that VM to the internet will use that specific IP address. This is the most direct and guaranteed method. Cloud NAT provides external IP addresses for VMs without public IPs, but while you can reserve a static NAT IP, pinning a specific VM to a specific NAT IP in a way that guarantees it's always used for that VM's egress isn't the primary design goal of Cloud NAT for individual VM control. Cloud Router manages BGP peering and routes, not NAT translations. Firewall rules filter traffic and can perform NAT (like SNAT), but they are not the primary mechanism for assigning a fixed egress IP to a VM in Google Cloud; direct assignment is simpler and more reliable for this specific requirement.