A Cloud Function needs access to other GCP resources. To enforce least privilege, what IAM/service-account setup should you use?

The correct approach for least privilege is to create a new service account with a custom IAM role. This role should only grant the specific permissions needed for the Cloud Function to interact with other GCP resources, avoiding broad roles like "Editor" which violate the principle of least privilege. The deployer then needs the iam.serviceAccounts.actAs permission on this new service account. This allows the deployer to deploy the Cloud Function using the new service account's identity, ensuring the function runs with only the necessary permissions. Granting permission to "get the access token" is less secure and not the standard way to assign service account identity to a Cloud Function.