title: Adding roles to service accounts on Google Cloud Platform using REST API
body: <p>I want to create a service account on GCP using a python script calling the REST API and then give it specific roles - ideally some of <a href="https://cloud.google.com/iam/docs/viewing-grantable-roles" rel="noreferrer">these</a>, such as <code>roles/logging.logWriter</code>.  </p>
  
  <p>First I make a request to <a href="https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/create" rel="noreferrer">create the account</a> which works fine and I can see the account in Console/IAM.<br>
  Second I want to give it the role and <a href="https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/setIamPolicy" rel="noreferrer">this</a> seems like the right method. However, it is not accepting <code>roles/logging.logWriter</code>, saying HttpError 400, <code>"Role roles/logging.logWriter is not supported for this resource."&gt;</code><br>
  Conversely, if I set the desired policy in console, then try the <code>getIamPolicy</code> method (using the gcloud tool), all I get back is response <code>etag: ACAB</code>, no mention of the actual role I set. Hence I think these roles refer to different things. </p>
  
  <p>Any idea how to go about scripting a role/scope for a service account using the API?</p>