I am using Privileged Access Manager(PAM) to temporarily assign roles to users/principals.

I know I can create an entitlement to assign the Service Account Token Creator role to a user account to enable that user to impersonate any service account.

Is there a way to restrict that role to only allow access to one specific service account and not just grant the ability to impersonate ANY service account?

I feel like this could be possible with IAM conditions but I was not able to figure out how to specify the specific service account resource in the IAM condition.