Question

A new engineer joined your team and needs to understand what a specific service account (data-pipeline@my-project.iam.gserviceaccount.com) is allowed to do within a project before troubleshooting a failing job. You want to quickly list all the IAM roles that have been granted to this service account at the project level. Which approach should you use?

Accepted Answer

Run 'gcloud projects get-iam-policy my-project' and filter the bindings for the service account's member entry

Answer

Run 'gcloud iam service-accounts describe data-pipeline@my-project.iam.gserviceaccount.com' to view its granted roles

Answer

Run 'gcloud iam service-accounts get-iam-policy data-pipeline@my-project.iam.gserviceaccount.com' to see the project roles

Answer

Inspect the JSON key file of the service account, which lists all roles the account holds