...
6. A .json file will be automatically downloaded by the browser.
...
...
A custom role is necessary if you are going to use backups and labels.
1. Go to IAM & admin, select "Roles" and click +Create Role.
...
Add the name and the description of the custom role. Set 'Role launch stage' as General Availability and click + Add Permissions.
...
For backups
...
For labels
...
compute.disks.get
compute.disks.createSnapshot
compute.disks.list
compute.disks.setLabels
compute.snapshots.create
compute.snapshots.delete
compute.snapshots.get
compute.snapshots.list
compute.snapshots.setLabels
compute.zones.get
compute.zones.list
...
bigquery.datasets.update
bigquery.tables.update
cloudsql.instances.update
compute.addresses.setLabels
compute.disks.setLabels
compute.forwardingRules.setLabels
compute.globalAddresses.setLabels
compute.globalForwardingRules.setLabels
compute.images.setLabels
compute.instances.setLabels
compute.snapshots.setLabels
compute.targetVpnGateways.setLabels
compute.vpnTunnels.setLabels
dataproc.clusters.update
dataproc.jobs.update
cloudkms.cryptoKeys.update
storage.buckets.update
3. Assign the custom role to the service account you have just created (IAM & admin → IAM → select the service account).
Enable Google APIs on Google Project
Go back to the Organization level.
1. Go to Select the project → APIs & Services.
...
2. Click +ENABLE APIS AND SERVICES.
...