Keigen | fast matrix operations and linear algebra | Math library

If we read the following GCP documentation ... https://cloud.google.com/solutions/connecting-securely#external

we find the following statement:

When instances do not have external IP addresses (including VMs that are backends for HTTPS and SSL proxy load balancers) they can only be reached by other instances on the network, Identity-Aware Proxy's TCP forwarding feature, or by using managed VPN gateway.

The key phrase to me is that they can only be reached .... It would thus appear that you can only reach a VM without a public IP using the recipes described in the article. If it were me, I'd consider actually giving the machine a public IP address and then following the recipes described in the article to only allow access to the machine through secured means. Google is promoting a story it called Beyond Corp which basically summarizes down to trust nothing. Every attempt to access any resource will be validated on a request by request basis and don't assume that lack of network access is enough to secure a resource. Instead, consider the notion that the VM can be publicly reachable but only authorized requests should be satisfied.