Just temporary add the user to yet another group with the needed permissions. Or use the IAM conditional policy. Or impersonate a service-account (which is more

Just temporary add the user to yet another group with the needed permissions. Or use the IAM conditional policy. Or impersonate a service-account (which is more or less the same as asuming AWS role) GCP's lack of "AWS role" concept is great and straigtforward. As well as its lack of both identity-bound policies and resource-bound policies at the same time.