Awesome post. It's a shame that Google's IAM is such a train wreck that you have to interact with three different servcies: Google Cloud, Google Admin, and Google Workspaces. And that someone had to figure out how to get this working by using Google's API explorers.