Doing it like this enables the use of a service account that only has the "Storage Object Admin" role.