google_iam_policy

data "google_iam_policy" "${admin}" {
   binding {
       role = "roles/compute.instanceAdmin"
           members = [
               "serviceAccount:your-custom-sa@your-project.iam.gserviceaccount.com",
           ]
   }
   binding {
       role = "roles/storage.objectViewer"
       members = [
           "user:evanbrown@google.com",
       ]
   }
}