I'm trying to find a solution to provide an external worker access to an instance in our project but not all resources.
I have done some research and found two methods on how to do this.
First would be to provide the contractor a private key to ssh into the selected instance.
But I would like to try and use the other method which is to assign the service account user role for the contractor.
From what I understand with service accounts. They are declared as both a resource and an identity. I would have to create a new instance under a newly created service account with limited defined permissions.
[service account] >>> permissions >>> [instances]
[user] >>> service account user role >>> [service account]
so I think the service account user role is like a proxy for the service account. I have tried to assign permissions to the service account and assigned a user with the service account user role. I would think that after this was done that the user would have the permissions assigned on to the service account. But unfortunately that isn't the case and I would like some assistance.