My understanding of the docs is you cannot do that level of fine grained access control for a given gce instance. You can only give it a gcs scope of read, write, or both