title: How do I grant a specific permission to a Cloud IAM service account using the gcloud CLI?
body: <p>I know that I can do it via the UI (Cloud Console), and that I can also assign a role. Although, how do I grant a single permission easily?</p>
  
  <p>For example, I was pushing an image to Google Container Registry with a newly created service account, and I got an error saying that this service account doesn't have the <code>storage.buckets.get</code> permission. What is the easiest way to grant this specific permission using the CLI?</p>