fix: grant apply serviceAccountTokenCreator

data.tf

@@ -5,17 +5,19 @@ data "google_storage_bucket" "state_bucket" {
 data "google_iam_policy" "github_actions_plan_sa_bindings" {
   // Allow the plan identity to act as the service account
   binding {
-    role = "roles/iam.workloadIdentityUser"
-
+    role    = "roles/iam.workloadIdentityUser"
     members = [local.github_actions_plan_identity]
   }
 }
 
 data "google_iam_policy" "github_actions_apply_sa_bindings" {
   // Allow the apply identity to act as the service account
   binding {
-    role = "roles/iam.workloadIdentityUser"
-
+    role    = "roles/iam.workloadIdentityUser"
+    members = [local.github_actions_apply_identity]
+  }
+  binding {
+    role    = "roles/iam.serviceAccountTokenCreator"
     members = [local.github_actions_apply_identity]
   }
 }