title: How to properly create gcp service-account with roles in terraform
body: <p>Here is the terraform code I have used to create a service account and bind a role to it:  </p>
  
  <pre><code>resource "google_service_account" "sa-name" {
    account_id = "sa-name"
    display_name = "SA"
  }
  
  resource "google_project_iam_binding" "firestore_owner_binding" {
    role               = "roles/datastore.owner"
    members = [
      "serviceAccount:sa-name@${var.project}.iam.gserviceaccount.com",
    ]
    depends_on = [google_service_account.sa-name]
  }
  </code></pre>
  
  <p>Above code worked great... except it removed the <code>datastore.owner</code> from any other service account in the project that this role was previously assigned to. We have a single project that many teams use and there are service accounts managed by different teams. My terraform code would only have our team's service accounts and we could end up breaking other teams service accounts.</p>
  
  <p>Is there another way to do this in terraform?</p>
  
  <p>This of course can be done via GCP UI or gcloud cli without any issue or affecting other SAs.</p>