Day 20: trying to figure out how Google Cloud IAM works