No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

any body know which pulumi resources i do need to use for this change?
```gsutil iam ch \
  serviceAccount:service-PROJECT_NUM@cloud-cdn-fill.iam.gserviceaccount.com:objectViewer \
  gs://[BUCKET]```


per <https://cloud.google.com/cdn/docs/using-signed-urls#configuring_google_cloud_storage_permissions>

tried
```const storageIam = new gcp.projects.IAMMember("cdnStorageIam", {
    member: `serviceAccount:service-${config.require("projectNumber")}@cloud-cdn-fill.iam.gserviceaccount.com`,
    project: gcpConfig.require("project"),
    role: "roles/storage.viewer",
});```


getting `googleapi: Error 400: Role roles/storage.viewer is not supported for this resource., badRequest`