DevOps needs full control of Compute Engine resources in the dev project but must not create or modify other project resources. Following Google guidance, what should you do?

Granting roles/viewer provides read-only access to all resources in the project, fulfilling the "must not create or modify other project resources" requirement for resources outside of Compute Engine. roles/compute.admin grants full control over Compute Engine resources, satisfying the "full control of Compute Engine resources" requirement. This combination adheres to the principle of least privilege by granting specific, necessary permissions. Creating a custom role with compute.instanceAdmin. permissions would only grant instance-related permissions, not full Compute Engine control. Granting roles/editor would give broad write access across the entire project, violating the "must not create or modify other project resources" constraint. Creating a custom role at the folder level would apply permissions too broadly, affecting multiple projects, which is not desired.