title: Google Cloud Network Admin vs Network User permission gap clarification
body: <p>Maybe a silly question but I can't get out of it.
  In Google Cloud a Shared VPC supports amongst others the major roles: Shared VPC Admin and Service Project Admin. Furthermore is advisable to define a Network Admin to administer networks in an Host Project:</p>
  
  <p><a href="https://cloud.google.com/vpc/docs/shared-vpc#iam_in_shared_vpc" rel="nofollow noreferrer">IAM Roles in Shared VPC</a></p>
  
  <p>What looks hard to understand for me is that while Google states:</p>
  
  <blockquote>
    <p>Important: The Network Admin role does not include all of the permissions in the Network User role. IAM > members having only the Network Admin role do not have permission to use the host project or subnets in > its Shared VPC networks.</p>
  </blockquote>
  
  <p>when I look to the single permissions of Network Admin vs Network User at:</p>
  
  <p><a href="https://cloud.google.com/iam/docs/understanding-roles#compute-engine-roles" rel="nofollow noreferrer">Compute Engine roles</a></p>
  
  <p>I do not see what permission is relevant to create VMs in a Subnet that the Network Admin does NOT contain whereas the Network User does! Apparently to me it looks like that the Network Admin contains by far more that what Network User does. Any idea?</p>