title: Google Cloud Compute Viewer allows to SSH while it should not
body: <p>I am trying to setup permissions on a per-instance level on our GCP infrastructure (for example, can SSH on machine A but not on machine B) using GCloud IAM permissions.</p>
  
  <p>However, I came across a weird behavior.</p>
  
  <p>If I add a user to the GCloud project with only the <code>Compute Viewer</code> permission, that user would be able to SSH on <strong>all</strong> the VM setup in the <code>Compute Engine</code> section.</p>
  
  <p>This makes no sense as the documentation itself states that you can't SSH with the <code>Compute Viewer</code>: <a href="https://cloud.google.com/compute/docs/access/" rel="nofollow noreferrer">https://cloud.google.com/compute/docs/access/</a></p>
  
  <p>Additionally, when I try to set permissions for each specific instance (by going in <code>Compute Engine</code> > <code>VM Instances</code>, selecting a specific instance and adding permissions from the permissions tab), those seem to have literally no effect.</p>
  
  <p>Not sure if I missed something:</p>
  
  <ul>
  <li>why does <code>Compute Viewer</code> allow for SSH?</li>
  <li>why does per-instance permissions have no effect?</li>
  </ul>