Google Cloud · Troubleshooting guide

GCP Troubleshooting: SSH Timeouts, 403 Permission Denied and Quota Exceeded Errors

A systematic path through the three most common Google Cloud roadblocks: unreachable VMs, IAM denials, and quota walls.

Published August 28, 2026 · RCW IT Training

VM access

gcloud compute ssh times out, but the serial console shows a login prompt

Work top-down: is the instance running, does a firewall rule allow port 22 from your range (gcloud compute firewall-rules list), and is sshd up inside the OS? Use the Serial Console and gcloud compute start-iap-tunnel to bypass the public path. If OS Login is enabled it replaces SSH keys - check gcloud compute os-login describe-profile and the project metadata flag enable-oslogin.

VM stuck in STOPPING, or terminated but will not start

Check zone health and your CPU quota for that zone, then read serial port 1 output for boot errors - a bad /etc/fstab entry is the classic blocker. A clean gcloud compute instances reset is safer than hammering start on a hung guest.

IAM and quota

403 PERMISSION_DENIED even though I am Owner on the project

Owner does not override organization policies, VPC Service Controls perimeters, or new IAM deny policies (deny beats allow). Read the 'permission' and 'resource' fields in the error, then test precisely with the Policy Troubleshooter or gcloud iam policies troubleshoot. Also verify the relevant service agent has its required grants.

QUOTA_EXCEEDED when creating VMs or GPUs

Quotas are per region: inspect limits with gcloud compute regions describe REGION, request increases in Console, IAM and Admin, Quotas with a business justification, and meanwhile spread workloads across regions. GPU and preemptible quotas are separate lines - request the exact one you need.

Key takeaway: For access issues, walk firewall, OS Login, then serial console in that order. For 403s, read the exact missing permission and use the Policy Troubleshooter instead of guessing roles.