IssueTracker

I want a service account be able to enable an Anthos API, I created a custom role to add the permission "serviceusage.services.enable" and attach the custom role into the service account with an IAM condition with the objective that only these specific service account enable the "anthosidentityservice.googleapis.com" API in my project

After the configuration I tried to run the next command: gcloud container fleet identity-service enable --fleet-default-member-config=auth-config.yaml --project [project] and throws an error message

The condition failed to give the permission to the service account

Looking at the documentation the API is not supported as a resource attribute and documentation for IAM condition and resource type that accept allow policies