is there a resource/* option to say that a service account has admin relation to all resources?