in theory we could also reuse this service account for other api (not only storage).