code: func importIdentities(c context.Context, cfg *config.ProjectsCfg) error {
  	storage := projectidentity.ProjectIdentities(c)
  
  	// TODO (fmatenaar): Make this transactional and provide some guarantees around cleanup
  	// but do this after we have a stronger story for warning about config changes which are
  	// about to remove an identity config from a project since this can cause an outage.
  	for _, project := range cfg.Projects {
  		if project.IdentityConfig != nil && project.IdentityConfig.ServiceAccountEmail != "" {
  			identity := &projectidentity.ProjectIdentity{
  				Project: project.Id,
  				Email:   project.IdentityConfig.ServiceAccountEmail,
  			}
  			logging.Infof(c, "updating project scoped account: %v", identity)
  			if _, err := storage.Update(c, identity); err != nil {
  				logging.Errorf(c, "failed to update project scoped account: %v", identity)
  				return err
  			}
  		}
  	}
  	return nil
  }
docs: // importIdentities analyzes projects.cfg to import or update project scoped service accounts.