Unclear how to add permissions to service accounts via IAM resource type

[MikaelSmith]

I can create a service account using the giam module, but it's unclear how to add permissions to that account. That's a barrier in automating deployment of new service instances that use those credentials to try to do things in Google Cloud.