Packer google cloud authentication within vpc

We are using Packer to build images in a GCP compute instance. Packer tries to grab the image based on project and image as follows:

https://www.googleapis.com/compute/v1/projects/<project-name>/global/images/<image-name>?alt=json

Then it throws an error: oauth2: cannot fetch token: Post https://accounts.google.com/o/oauth2/token: dial tcp 108.177.111.84:443: i/o timeout

Based on security principle, our compute instance has no external IP address, therefore it does not have access to internet. In this case, accounts.google.com is no longer accessible. Then how can we authenticate google apis?

I tried to enable firewall rules and provide routes for internet access. But based on the requirement stated here, the instance still won't have access if it does not have external IP address.

This means we must have a separate way to authenticate googleapis. But does Packer support this?

Here is the packer builder we have:

"builders": [
    {
        "type": "googlecompute",
        "project_id": "test",
        "machine_type": "n1-standard-4",
        "source_image_family": "{{user `source_family`}}",
        "source_image": "{{user `source_image`}}",
        "source_image_project_id": "{{user `source_project_id`}}",
        "region": "{{user `region`}}",
        "zone": "{{user `zone`}}",
        "network": "{{user `network`}}",
        "subnetwork": "{{user `subnetwork`}}",
        "image_name": "test-{{timestamp}}",
        "disk_size": 10,
        "disk_type": "pd-ssd",
        "state_timeout": "5m",
        "ssh_username": "build",
        "ssh_timeout": "1000s",
        "ssh_private_key_file": "./gcp-instance-key.pem",
        "service_account_email": "test-account@test-mine.iam.gserviceaccount.com",
        "omit_external_ip": true,
        "use_internal_ip": true,
        "metadata": {
            "user": "build"
        }
    }