Finds GCP service accounts without any remaining IAM permissions - useful to find and remove old serviceaccounts after 90 day unused IAM permissions clean out
You can optionally specify the GCP project, otherwise infers your currently set core.project
If you specify 'all'for project, will return a sorted superset list from all projects
"
# used by usage() in lib/utils.sh
# shellcheck disable=SC2034
usage_args="[<project_id>]"
help_usage "$@"
#min_args 1 "$@"
project="${1:-}"
if is_blank "$project";then
project="$(gcloud config list --format='get(core.project)')"
fi
not_blank "$project"|| die "ERROR: no project specified and GCloud SDK core.project property not set in config"
get_unused_identities(){
localproject="$1"
identities_in_use="$("$srcdir/gcp_iam_identities_in_use.sh""$project"| grep '^serviceAccount:'| sed 's/^[^:]*://')"
gcloud iam service-accounts list --format='get(email)' --project "$project"|