> ./Add-KmsPermissions.ps1 my-service-account
Adding role roles/cloudkms.cryptoKeyDecrypter to my-service-account@my-google-project-id.iam.gserviceaccount.com for projects/my-google-project-id/locations/global/keyRings/appsecrets.
Updated IAM policy for keyring [appsecrets].
bindings:
- members:
  - serviceAccount:my-google-project-id@appspot.gserviceaccount.com
  - serviceAccount:my-service-account@my-google-project-id.iam.gserviceaccount.com
  - serviceAccount:surferjeff-test2@appspot.gserviceaccount.com
  role: roles/cloudkms.cryptoKeyDecrypter
etag: BwV_csWvPRk=
Adding role roles/cloudkms.admin to my-service-account@my-google-project-id.iam.gserviceaccount.com for dataprotectionprovider.
Updated IAM policy for keyring [dataprotectionprovider].
bindings:
- members:
  - serviceAccount:my-google-project-id@appspot.gserviceaccount.com
  - serviceAccount:my-service-account@my-google-project-id.iam.gserviceaccount.com
  role: roles/cloudkms.admin
- members:
  - serviceAccount:my-google-project-id@appspot.gserviceaccount.com
  role: roles/cloudkms.cryptoKeyEncrypterDecrypter
etag: BwV_csfdx_k=
Adding role roles/cloudkms.cryptoKeyEncrypterDecrypter to my-service-account@my-google-project-id.iam.gserviceaccount.com for dataprotectionprovider.
Updated IAM policy for keyring [dataprotectionprovider].
bindings:
- members:
  - serviceAccount:my-google-project-id@appspot.gserviceaccount.com
  - serviceAccount:my-service-account@my-google-project-id.iam.gserviceaccount.com
  role: roles/cloudkms.admin
- members:
  - serviceAccount:my-google-project-id@appspot.gserviceaccount.com
  - serviceAccount:my-service-account@my-google-project-id.iam.gserviceaccount.com
  role: roles/cloudkms.cryptoKeyEncrypterDecrypter
etag: BwV_csfuxPw=