Service accounts are both identities and resources. Because service accounts are identities, you can let a service account access resources in your project by granting it a role, just like you would for any other principal.

https://cloud.google.com/sdk/gcloud/reference/compute/networks/subnets/expand-ip-range

Workspaces is made for monitoring multiple projects.

You don't need data access logs and configuration counts as creation.

roles/viewer Read access to all resources. Get and list access for all resources.
Using primitive roles
The following table lists the primitive roles that you can grant to access a project, the description of what the role does, and the permissions bundled within that role. Avoid using primitive roles except when absolutely necessary. These roles are very powerful, and include a large number of permissions across all Google Cloud services. For more details on when you should use primitive roles, see the Identity and Access Management FAQ.
IAM predefined roles are much more granular, and allow you to carefully manage the set of permissions that your users have access to. See Understanding Roles for a list of roles that can be granted at the project level. Creating custom roles can further increase the control you have over user permissions.
https://cloud.google.com/resource-manager/docs/access-control-proj#using_primitive_roles