Query: iam_project_no_service_account_token_creator_role

select
  address as resource,
  case
    when (attributes_std ->> 'role') like any (
      array [ 'roles/iam.serviceAccountUser',
      'roles/iam.serviceAccountTokenCreator' ]
    ) then 'alarm'
    else 'ok'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std ->> 'role') like any (
      array [ 'roles/iam.serviceAccountUser',
      'roles/iam.serviceAccountTokenCreator' ]
    ) then ' service account roles assigned'
    else ' no service account roles assigned'
  end || '.' reason,
  path || ':' || start_line
from
  terraform_resource
where
  type in (
    'google_project_iam_member',
    'google_project_iam_binding'
  );