How to give service account only access to one bucket? If you just in case wanna give another 3rd party service access to your priv