How do create a Role (permission) enable very narrow scope - to a specific resource by ID or Label.
All documentation/examples seemingly are All Resources of a Type (Compute, etc) to All in a Project or Organization.
I want to give my Testers on labels "test" etc. Also to a very specific "instance-ID".
Cant find any example. Thanks
As it was mentioned by @John Hanley above, you can assign a service account to a specific compute instance and a few other resources by clicking on the info panel on the right side of the resource. For example, go to VM Instances in the Google Cloud Console, click a checkbox next to an instance name and then click the "SHOW INFO PANEL" button near the top right of the page. AFAIK there is no support for specifying tags as conditions. You can use a resource name as a condition. Example: resource.name.startsWith. More details you can find at the documentation Overview of IAM Conditions.
As a possible solution, you can file a feature request at the Google Issue Tracker to change this behavior.
