A single person manages creation and lifecycle of all service accounts for projects. Assign the minimum project-level IAM role they need. What should you do?

The roles/iam.serviceAccountAdmin role grants permissions to manage service accounts, including creating, deleting, and updating them, as well as managing their keys. This is the minimum project-level role required for a user to manage the creation and lifecycle of all service accounts within a project. roles/iam.roleAdmin allows managing custom IAM roles, not service accounts. roles/iam.securityAdmin is a broader role for managing security policies and firewall rules, which is more than what's needed for just service account management. roles/iam.serviceAccountUser allows impersonating a service account, but not managing its creation or lifecycle.