Possibly over-privileged service account in scheduled-asset-inventory-export-bq

[kbroughton]

On line 39 of the scheduled-asset-inventory-export-bq/main.tf the robot service account is granted projectIamAdmin.

"roles/resourcemanager.projectIamAdmin" = ["serviceAccount:${module.project.service_accounts.robots.cloudasset}"]

Granting project-wide admin is generally discouraged. Is such a high privilege really needed?

[ludoo]

@lcaggio can you take a look? if that's really needed, we might want to limit it via delegated role grants.

[juliocc]

@lcaggio can you tal?

[ludoo]

@lcaggio can you check this, or should we close it?