title: How to assign roles to a service account using deployment manager
body: <p>had some trouble creating a service account and assigning roles to it. Initially I based my code on <a href="https://github.com/GoogleCloudPlatform/deploymentmanager-samples/blob/master/google/resource-snippets/iam-v1/service_accounts.jinja" rel="nofollow noreferrer">this example</a> however I couldn't get it to work because while it does create the service account it does not assign roles to it. So I looked around on stackoverflow and found <a href="https://stackoverflow.com/a/49416120/11028177">this answer</a> which does work.</p>
  
  <p>Pasted below is the content of Jinja file responsible for creating the service-account that doesn't work. What I expect it do is is create a service account and then assign pubsub.editor and dataflow.developer roles to it.</p>
  
  <p>I don't understand why the code below doesn't work so I'm hoping someone can explain what is wrong with it.</p>
  
  <pre><code>{# Service account creation #}
  resources:
  - type: gcp-types/iam-v1:projects.serviceAccounts
    name: {{ env['name'] }}
    properties:
      accountId: {{ env['name'] }}
      displayName: serviceAccount-{{ env['name'] }}
    accessControl:
      gcpIamPolicy:
      bindings:
      - role: roles/dataflow.developer
        members:
        - "serviceAccount:myaccount-sa@myproject.iam.gserviceaccount.com"
      - role: roles/pubsub.editor
        members:
        - "serviceAccount:myaccount-sa@myproject.iam.gserviceaccount.com"
  </code></pre>