why only network tag works for creating firewall to SSH an instance?

I was trying to create a firewall rule that involves target as service account, but, it was not working while I was trying to SSH. Why only targets as network tag work here?