Google Cloud Platform

# Set these two values, then run the script.
PROJECT_ID="your-project-id"
SA_NAME="iru-compliance"
SA_EMAIL="${SA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"

gcloud config set project "$PROJECT_ID"

# 1. Create the service account
gcloud iam service-accounts create "$SA_NAME" \
  --display-name="Iru Compliance"

# 2. Bind the read-only roles at the project level
for ROLE in \
  roles/iam.securityAuditor \
  roles/bigquery.dataViewer \
  roles/cloudkms.viewer \
  roles/compute.networkViewer \
  roles/logging.viewer \
  roles/storage.bucketViewer
do
  gcloud projects add-iam-policy-binding "$PROJECT_ID" \
    --member="serviceAccount:${SA_EMAIL}" \
    --role="$ROLE"
done

# 3. Create the JSON key in the current directory
gcloud iam service-accounts keys create iru-compliance-key.json \
  --iam-account="$SA_EMAIL"