The iam.serviceAccountUser role (or serviceAccountUser) is required to impersonate or run resources as a service account (e.g., instance or Cloud Run identity). Create SA is creator, view IAM is viewer, KMS is separate.