An external contractor needs SSH access to a specific Compute Engine instance named 'db-admin-vm' to perform maintenance. You do not want to grant them IAM access to the Google Cloud project.

How should you provide them access?

If you need to grant SSH access to a specific VM without granting IAM permissions (like OS Login), you can manage SSH keys manually via metadata. To restrict access to only the 'db-admin-vm', you must add the contractor's public SSH key to the instance-level metadata of that specific VM. Adding it to project-level metadata would grant access to other VMs in the project.