Requiring permission to attach service accounts to resources | IAM Documentation | Google Cloud