To configure permissions for a service account to act as an identity that can manage other GCP resources, use the googleProjectIam set of resources.