PermissionexternalAccountKeyCreator
publicca.externalAccountKeys.create
resourcemanager.projects.get
resourcemanager.projects.list