code: def _add_iam_policy_binding(service_account, roles):
      
      project_id = service_account["projectId"]
      email = service_account["email"]
      member_id = "serviceAccount:" + email
  
      policy = crm.projects().getIamPolicy(resource=project_id).execute()
  
      already_configured = True
  
      for role in roles:
          role_exists = False
          for binding in policy["bindings"]:
              if binding["role"] == role:
                  if member_id not in binding["members"]:
                      binding["members"].append(member_id)
                      already_configured = False
                  role_exists = True
  
          if not role_exists:
              already_configured = False
              policy["bindings"].append({
                  "members": [member_id],
                  "role": role,
              })
  
      if already_configured:
          # In some managed environments, an admin needs to grant the
          # roles, so only call setIamPolicy if needed.
          return
  
      result = crm.projects().setIamPolicy(
          resource=project_id, body={
              "policy": policy,
          }).execute()
  
      return result
docs: Add new IAM roles for the service account.