also need some advice on importing service accounts, eg:

<mailto:name@project.iam.gserviceaccount.com|name@project.iam.gserviceaccount.com>

wouldn't that be

new gcp.serviceAccount.Account("name", {
    displayName: "name",
    accountId: "name",
    project: "project"
}, { import: "111111111111111111111" }) // id from url of gcp console

? (lemme know if these import questions become annoying ;)

I think it should be

id

as cloud provider sets it: "projects/$proj/serviceAccounts/xxxx@zzzz.iam.gserviceaccount.com",

perfect, thanks!