How to add cloudsql role to a service account via cloud-deployment-manager

I'm trying to add the cloudsq.client role to a service account via the cloud deployment manager. How do i do this?

I figured out that i can add primitive roles like role/owner with the pubsub.v1.topic resourceType. See the official google example:

resources:
- name: {{ env['name'] }}
  type: pubsub.v1.topic
  properties:
    topic: {{ env['name'] }}
  accessControl:
    gcpIamPolicy:
      bindings:
      - role: roles/pubsub.subscriber
        members:
        - "serviceAccount:$(ref.{{ properties['serviceAccountId'] }}.email)"

But it seems like that this doesn't work with role/cloudsql.client: It says:

"message":"Role roles/cloudsql.client is not supported for this resource."

I figured out through Can't create cloudsql role for Service Account via api that i most likely have to use the cloudresourcemanager.v1.project resource. But just replacing the resources doesn't work either:

resources:
- name: {{ env['name'] }}
  type: cloudresourcemanager.v1.project
  properties:
    projectId: {{ env['project'] }}
  accessControl:
    gcpIamPolicy:
      bindings:
      - role: roles/cloudsql.client
        members:
        - "serviceAccount:$(ref.{{ properties['serviceAccountId'] }}.email)"

Error:

- code: RESOURCE_ERROR
  location: /deployments/test-cluster/resources/cloudsql-client-role
  message: '{"ResourceType":"cloudresourcemanager.v1.project","ResourceErrorCode":"403","ResourceErrorMessage":{"code":403,"message":"Service
    accounts cannot create projects without a parent.","status":"PERMISSION_DENIED","statusMessage":"Forbidden","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects","httpMethod":"POST"}}'

Im kinda stuck so i appreciate every help i can get!