Watch on YouTube: https://youtu.be/bLKt_UoNdjY?si=xX6NXQc1pE2TDaN8

Connect to a Google Cloud VM with SSH Key

This guide follows my video, Connect Google Cloud VM in 2 Minutes Using SSH Key. It shows the basic workflow for preparing a Google Cloud VM, creating or using an SSH key, and connecting securely from a local terminal.

Video: Watch the full Google Cloud SSH walkthrough

Requirements

A Google Cloud account with billing enabled for the resources you use.
A Google Cloud project and permission to create or access a Compute Engine VM.
A running Linux VM with an external IP address, or an approved private access path.
OpenSSH installed locally. Linux and macOS usually include it; Windows 10 and 11 include OpenSSH Client as an optional feature.
A terminal or PowerShell window.

1. Prepare the VM

Open Google Cloud Console > Compute Engine > VM instances and select the VM you want to access. Note these values:

The VM external IP address.
The VM zone and project.
The operating system user you intend to use.
The firewall policy applied to the VM.

Make sure the VM is running and that SSH access is allowed. Google Cloud normally uses TCP port 22 for SSH.

2. Create an SSH Key Pair

If you do not already have a key pair, create one locally. On Linux or macOS:

ssh-keygen -t ed25519 -C "your-email@example.com"

On Windows PowerShell, the same command works when OpenSSH Client is installed:

ssh-keygen -t ed25519 -C "your-email@example.com"

Press Enter to accept the default file path, or choose a dedicated path such as ~/.ssh/google-cloud-ed25519. Protect the private key with a passphrase.

This creates:

A private key, which must stay on your computer.
A public key ending in .pub, which can be added to the VM account.

Never share the private key or commit it to a repository.

3. Add the Public Key

Use one of Google Cloud’s supported methods:

Add the public key through the VM or project SSH key settings in Cloud Console.
Use OS Login when it is enabled by the project administrator.
Use the Google Cloud CLI to connect, which can manage the key metadata for you.

For a simple Cloud Console flow, open the VM settings, find the SSH key section, paste the complete contents of your .pub file, and save the changes. Keep the username in the key entry consistent with the username you will use in the SSH command.

4. Connect from Linux

On Linux, open your terminal, protect the private key, and connect with OpenSSH:

chmod 600 ~/.ssh/google-cloud-ed25519
ssh -i ~/.ssh/google-cloud-ed25519 USERNAME@EXTERNAL_IP

For example:

ssh -i ~/.ssh/google-cloud-ed25519 abhay@203.0.113.10

If you use the Google Cloud CLI, you can also connect by project and zone. The CLI can create or reuse the SSH key configuration for you:

gcloud compute ssh VM_NAME --zone=ZONE --project=PROJECT_ID

Replace VM_NAME, ZONE, and PROJECT_ID with the values for your VM. Install and authenticate the Google Cloud CLI first if gcloud is not available.

5. Connect from Windows PowerShell

From Windows PowerShell, use the VM username, external IP, and private key path:

ssh -i $env:USERPROFILE\.ssh\google-cloud-ed25519 USERNAME@EXTERNAL_IP

You can also use the Google Cloud CLI from PowerShell:

gcloud compute ssh VM_NAME --zone=ZONE --project=PROJECT_ID

Confirm the host fingerprint the first time you connect. Enter your key passphrase when prompted.

6. Verify the Session

After connecting, confirm the remote host and current user:

whoami
hostname
uname -a

Update the VM packages before installing software:

sudo apt update && sudo apt upgrade -y

Use the package manager for the VM distribution if it is not Debian or Ubuntu.

Troubleshooting

Permission denied (publickey)

Check the username, private key path, public key entry, and private key permissions. On Linux or macOS:

chmod 600 ~/.ssh/google-cloud-ed25519

Run SSH in verbose mode to inspect authentication:

ssh -v -i ~/.ssh/google-cloud-ed25519 USERNAME@EXTERNAL_IP

Connection timed out

Confirm that the VM is running, the external IP is current, and a firewall rule allows TCP port 22 from your source network. Avoid opening SSH to the entire internet when a restricted source range is possible.

The VM has no external IP

Use Google Cloud IAP TCP forwarding, a bastion host, VPN, or another approved private access method instead of exposing the VM publicly.

Host key warning after a VM rebuild

If the VM was recreated and its host key changed, verify the new fingerprint before updating your local known_hosts file. Never disable host key checking blindly.

Security Checklist

Keep the private key private and protected by a passphrase.
Restrict firewall source ranges for TCP port 22.
Prefer OS Login or IAP for managed environments.
Remove unused keys and users.
Keep the VM and SSH server updated.
Disable password authentication when your access model supports it.