need help on manage GCE instances with Ansible.

I am trying to use a Compute Engine instance to manage all my nodes within the project.

so far I am able to create instances without issues, but somehow I am not able to go further and use ansible to manage those nodes. it seems to have problem to ssh to the newly created instances, I went through all information I google’d, but did not help. I am using a service account just like what ansible document says.

below is one of the sample I used, it actually created a “dev” instance successfully but failed to wait for ssh to the public_ip of the new node. do I have to enable firewall rule or something like that ?

- name: Create instance(s)
  hosts: localhost
  gather_facts: no
  connection: local

  vars:
    machine_type: f1-micro # default
    image: debian-8
    service_account_email: xxxxx@iam.gserviceaccount.com
    credentials_file: xxxxx
    project_id: xxxxx

  tasks:
    - name: Launch instances
      gce:
          instance_names: dev
          machine_type: "{{ machine_type }}"
          image: "{{ image }}"
          service_account_email: "{{ service_account_email }}"
          credentials_file: "{{ credentials_file }}"
          project_id: "{{ project_id }}"
          tags: webserver
      register: gce

    - name: Wait for SSH to come up
      wait_for: host={{ item.public_ip }} port=22 delay=10 timeout=60
      with_items: "{{ gce.instance_data }}"

any idea ?