^^ please ignore, the only issue was the way of retrieving service account it, the following fixes it:

envManagementAccount.id.apply(
    (envMgmtId) =>
      new confluentcloud.RoleBinding(
        `...`,
        {
          principal: `User:${envMgmtId}`,
          roleName: 'CloudClusterAdmin',
          crnPattern: clusterConfig.cluster.rbacCrn,
        },
      )
  );