fix: grant apply serviceAccountTokenCreator

data.tf

@@ -5,25 +5,27 @@ data "google_storage_bucket" "state_bucket" {
 data "google_iam_policy" "github_actions_plan_sa_bindings" {
   // Allow the plan identity to act as the service account
   binding {
-    role = "roles/iam.workloadIdentityUser"
-
+    role    = "roles/iam.workloadIdentityUser"
     members = [local.github_actions_plan_identity]
   }
 }
 
 data "google_iam_policy" "github_actions_apply_sa_bindings" {
   // Allow the apply identity to act as the service account
   binding {
-    role = "roles/iam.workloadIdentityUser"
-
+    role    = "roles/iam.workloadIdentityUser"
+    members = [local.github_actions_apply_identity]
+  }
+  binding {
+    role    = "roles/iam.serviceAccountTokenCreator"
     members = [local.github_actions_apply_identity]
   }
 }
 
 data "google_iam_policy" "state_bucket" {
   // Plan action service account state bucket binding
   binding {
-    role = "roles/storage.objectUser"
+    role    = "roles/storage.objectUser"
     members = [
       google_service_account.github_actions_plan.member,
       google_service_account.github_actions_apply.member