Basically, we want a setup that will allow only one service account (that we intend to use for production use-cases) to run queries on a particular project. No other account should be able to run queries.
Is this possible? How can we go about doing this?
You have to create the service account and gives it all the needed privileges to run queries on this particular project.
You also have to check that no other service account has privileges allowing to perform query on this project.
With IAM you have all the flexibility to do that, and with the least privilege concept, you can create a custom role on IAM and give only the needed permissions to your Service Account.
