The hint from the error message is that tries the public key approach and not the tunnel approach. Try using Cloud Shell and work on the permissions and firewall as described in the article until the first command works. This way you validate that it goes through tunnel and not via public key.

```

# ssh into vm

gcloud compute ssh $INSTANCE_NAME --zone $ZONE --tunnel-through-iap

```