In my GCP project, as a project owner SSH option is enabled on browser for me on an VM instance with NO External IP but Not for other users who have Compute Admin and with "roles/iam.serviceAccountUser" to compute service account. The same users are able to SSH via browser and using Cloud IAP in shell to instances with External IPs.
Even if the instance is created by the User, he is not having the browser SSH enabled and it is enabled for the project owner.
What configuration is allowing the project owner role to have the browser SSH enabled for instances with NO External IP, and disabled for other users?
I have gone through google documentation on SSH, permissions etc. Everywhere, it says ways to access the instances with no external IP, which is helpful if owner also cannot SSH from browser. I understand we can SSH other ways to the instances. I would like to know what permission/role enabled an owner to SSH from browser.