[plucas]

My assumption is by creating a service account with limited privileges and activating it for gcloud when running this.

[benterix]

Yes, in the meantime I figured out it's basically assigning it the Reader IAM role in GCP.