Not all GCP roles can be applied at 'resource' level. In fact - for most roles - the lowest level a role can be applied at is 'project'.
For example, compute.instanceAdmin role can only be applied at org/folder/project levels while pubsub.editor role can be applied at org/folder/project/topic levels.
More info here: https://cloud.google.com/iam/docs/understanding-roles#compute_engine_roles
@aamarh Custom roles are covered in the part 2 course. At the time custom roles were in beta, but the same concepts still apply. You can find the lesson here: https://linuxacademy.com/cp/courses/lesson/course/1327/lesson/2/module/143