I basically want a new SA with only the role `roles/cloudkms.cryptoKeyEncrypterDecrypter`.
b
I basically want a new SA with only the role
roles/cloudkms.cryptoKeyEncrypterDecrypter
.