Looks like changing service_account to serviceaccount fixed the issue. This is similar issue to this: https://github.com/pulumi/pulumi-gcp/issues/410 I'll comment there too