Steps

• Enable APIs (especially easy to forget Cloud Identity-Aware Proxy API)
• Create VPC network
• Create GCE instance (assign a network tag)
• Allow access from Cloud Identity-Aware Proxy (35.235.240.0/20) and from the client via firewall (port 22 only, associated with GCE's network tag)
• Log in via the SSH button in the GCP portal
• Stop firewalld and SELinux

   systemctl stop firewalld && systemctl disable firewalld
   vi /etc/selinux/config # Set 'SELINUX=disabled'. Don't forget to run reboot

• Add a user

   useradd [username]

• Create a private key and public key on the client
• Add the SSH public key

   vi /home/[username]/.ssh/authorized_keys # Add the public key. Don't forget the username at the end of the line.

• Connect from the client via SSH

Key Points

• The default network may have been modified in various ways. Create a new VPC network.
• After setting up the firewall, first check connectivity from the client side using nc or Test-NetConnection.
• Confirm that sshd is running
• If you get an error like Permission denied, check the SSH log (/var/log/secure)

That's all.