Blog post idea: provide an example how to run pulumi with short lived key for it's service account (https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials)