title: How to use GCP Service Account User Role to create resource?
body: <p>On GCP document:</p>
  <blockquote>
  <p>Users granted the Service Account User role on a service account can use it to indirectly access all the resources to which the service account has access. For example, if a service account has been granted the Compute Admin role (roles/compute.admin), a user that has been granted the Service Account Users role (roles/iam.serviceAccountUser) on that service account can act as the service account to start a Compute Engine instance. In this flow, the user impersonates the service account to perform any tasks using its granted roles and permissions.</p>
  </blockquote>
  <p>So I would like to try this feature:</p>
  <ol>
  <li>Create a project</li>
  <li>Add <code>testuser@example.com</code> to the project and grant Viewer role.</li>
  <li>Open a new browser and login into GCP console with <code>testuser</code>, and confirmed that the user can only view instances and cannot create instance.</li>
  <li>Add a service account: <code>sa-name@project-id.iam.gserviceaccount.com</code>, and grant <code>Compute Admin</code> role, so this service account can create instance.</li>
  <li>Grant <code>testuser@example.com</code> with <code>service account user</code> role to this service account.</li>
  </ol>
  <p>So per above GCP document, I expect <code>testuser@example.com</code> can create instance, but the <code>Create instance</code> button remains disabled.</p>
  <p>Then I grant <code>testuser@example.com</code> with <code>service account user</code> role in project level, still the <code>Create instance</code> button remains disabled.</p>
  <p>So what is wrong?</p>
  <ol>
  <li><p>Am I understanding wrong? grant <code>testuser@example.com</code> with <code>service account user</code> role does not give testuser the ability to create instance?</p>
  </li>
  <li><p>Am I doing something wrong?</p>
  </li>
  <li><p>How can I create instance by <code>service account user</code>?</p>
  </li>
  </ol>