源文件
gcp/iam/cloud-build-sa.yaml

离线配置。未部署到任何云账号。
sa: cloud-build-sa
email: cloud-build-sa@thistle-analytics-demo.iam.gserviceaccount.com
purpose: deploy
description: Cloud Build identity. run.admin and artifactregistry.writer are scoped to this service and this repository.
bindings:
  - member: serviceAccount:cloud-build-sa@thistle-analytics-demo.iam.gserviceaccount.com
    role: roles/run.admin
    resource: projects/thistle-analytics-demo/locations/asia-east1/services/insights-api
    purpose: deploy
    sa: cloud-build-sa
  - member: serviceAccount:cloud-build-sa@thistle-analytics-demo.iam.gserviceaccount.com
    role: roles/artifactregistry.writer
    resource: projects/thistle-analytics-demo/locations/asia-east1/repositories/apps
    purpose: deploy
    sa: cloud-build-sa
  - member: serviceAccount:cloud-build-sa@thistle-analytics-demo.iam.gserviceaccount.com
    role: roles/iam.serviceAccountUser
    resource: projects/thistle-analytics-demo/serviceAccounts/insights-api-sa@thistle-analytics-demo.iam.gserviceaccount.com
    purpose: deploy
    sa: cloud-build-sa