Workload identity pool admin role automatically when SA is project owner

[mvarchdev-smw]

Hello! We have pulumi program for managing our google cloud platform infrastructure.

I bumped into issue that when Service account will create project in folder, while it is project owner/admin automatically, it does not have access to creating workload identity provider pools and things about that.

For that you need to have assigned this role: `roles/iam.workloadIdentityPoolAdmin`

Is there some way to automate/set it natively in GCP, so project owner (in my case, service account) will have admin access to that?

One solution is that I could set that wip admin role to folder for that service account, but then, it would have access to manage all identity pools in all projects in that folder. I need it, to have access only to project that it will create (becaouse I have project per env: prod, staging, develop and automatic pull request projects)

Related issues:
https://issuetracker.google.com/issues/215575175?pli=1
https://github.com/hashicorp/terraform-provider-google/issues/11789