Google Cloud Platform example to add IAM role restricting user to specific storage buckets with conditions