Interesting, so this approach still works through an explicitly created service account? Do you think it's possible to make it work without a GCP Service Account at all?