On the Google Cloud side, Identity-Aware Proxy does something similar: Your SSH connection is authenticated with your Google Cloud CLI credential (an OAuth 2.0 credential), and is tunneled through IAP, so you don't need a firewall opening, or even a public IP address.