How GCP Service Accounts Work for Database Access Tools

Most GCP connection guides skip the IAM details. Here's exactly which service account roles a database tool needs - and which to avoid.