Optimize IAM role assignments per policy of least privilege

[rogerthatdev]

Proposal

Applying a principle of least privilege by:

• replacing default service accounts with custom service accounts
• narrowing the function of an individual service account, where possible
• leveraging individual resource IAM policy bindings in lieu of project IAM policy bindings, where possible
• limiting the IAM roles and permissions granted to service accounts with custom IAM roles, where possible

Problems this will solve

Demonstrate security best practices and better secure our projects

Alternatives

N/A

Additional context

Related:

• Add check for unnecessary GCP permissions #131
• (Journey) SJ17: Limit blast radius of a security exploit #45
• cloud-run-manager service account should be for Cloud Build #254
• Decision: allow CBSA to set IAM policies #422

[grayside]

This issue seems to be a repeat of the intention on #45.