code: def _grant_roles_to_service_account(
      self,
      credentials: Credentials,
      project_id: str,
      service_account_email: str,
  ):
      service = googleapiclient.discovery.build(
          "cloudresourcemanager", "v1", credentials=credentials
      )
      try:
          policy = (
              service.projects()
              .getIamPolicy(resource=project_id)
              .execute()
          )
          self._add_roles_to_policy(
              policy=policy,
              service_account_email=service_account_email,
              roles=self._get_service_account_roles(),
          )
          service.projects().setIamPolicy(
              resource=project_id, body={"policy": policy}
          ).execute()
      except googleapiclient.errors.HttpError as e:
          if e.status_code == 403:
              raise ServerClientError(
                  "Not enough permissions. Default credentials must have Security Admin role.",
              )
          raise e
  
imports: import json
  from typing import Dict, List
  import googleapiclient.discovery
  import googleapiclient.errors
  from google.auth.credentials import Credentials
  from dstack._internal.core.backends.gcp import GCPBackend, auth
  from dstack._internal.core.backends.gcp import utils
  from dstack._internal.core.backends.gcp.config import GCPConfig
  from dstack._internal.core.errors import BackendAuthError, ServerClientError
  from dstack._internal.core.models.backends.base import BackendType, ConfigElement, ConfigElementValue, ConfigMultiElement
  from dstack._internal.core.models.backends.gcp import AnyGCPConfigInfo, GCPConfigInfo, GCPConfigInfoWithCreds, GCPConfigInfoWithCredsPartial, GCPConfigValues, GCPCreds, GCPDefaultCreds, GCPServiceAccountCreds, GCPStoredConfig
  from dstack._internal.server import settings
  from dstack._internal.server.models import BackendModel, ProjectModel
  from dstack._internal.server.services.backends.configurators.base import Configurator, raise_invalid_credentials_error
label_desc: Use image node_id 10 for calling the GCPConfigurator obj's underlying member method code with example usage: obj._grant_roles_to_service_account(credentials, project_id, service_account_email) without return types