Your application on Google App Engine needs to access Google Cloud Storage and Google BigQuery to store files and perform queries, respectively. You want to use a single service account for both services with the least privilege required. Which role should you assign to the service account?