Which role lets a principal attach a service account to a resource, but does not let the principal use --impersonate-service-account?

Which IAM role type should generally not be used in production because it is highly permissive?...

Which role allows a principal to create short-lived credentials for a service account and use the gc...

A contractor must upload objects to a bucket but must not be able to view, delete, or overwrite exis...

An analyst needs to read objects and list bucket contents, but must not modify data. Which Cloud Sto...

A security team wants firewall rules to follow VM identity and be harder for instance admins to alte...