gcloud confusion about set/get IAM policy for a service account

Question

There are 2 commands I am confused for some time:

gcloud iam service-accounts get-iam-policy
gcloud iam service-accounts set-iam-policy

from the --help command, these 2 commands treat service account as a resource, most often I use service account as an identity, for example, in a project, set policy by binding role with service account so this service account can operate on something in that project.

Can someone please point out what is the usage to attach the policy to service account? how does service account act as a resource rather than an identity?

Answer 1

As explained in this below part of the official documentation Managing service accounts :

When thinking of a service account as a resource, you can grant roles to other users to access or manage that service account.

So, use it as a resource has to goal for you to manage who can use and control the service account. To provide some additional details, as in this example here, with the policies attached to them, you can configure the level of access that different users can have within service accounts - as mentioned there, you can configure that some users have viewer access, while others have editor level.

To summarize, the functinality of attaching policies to a service account is for you to set different levels of access and permissions to users who can access the service account.