Comment by plucas

My assumption is by creating a service account with limited privileges and activating it for gcloud when running this.