If you diff those, you'll find that I had to add information about the tags and the email for the service account, along with a bunch of account scopes.