Override primary flag for the storage transfer service agent (#2445)

modules/project/service-agents.yaml

@@ -952,7 +952,7 @@
   display_name: Firebase App Hosting Service Account
   api: firebaseapphosting.googleapis.com
   identity: service-%s@gcp-sa-firebaseapphosting.iam.gserviceaccount.com
-  role: null
+  role: roles/firebaseapphosting.serviceAgent
   is_primary: true
   aliases: []
 - name: firebasemods
@@ -1412,7 +1412,7 @@
   api: storagetransfer.googleapis.com
   identity: project-%s@storage-transfer-service.iam.gserviceaccount.com
   role: null
-  is_primary: false
+  is_primary: true
   aliases: []
 - name: stream
   display_name: Stream Service Account

tools/build_service_agents.py

@@ -41,6 +41,10 @@ ALIASES = {
     'serverless-robot-prod': ['cloudrun', 'run'],
 }
 
+PRIMARY_OVERRIDE = {
+    'storage-transfer-service': True,
+}
+
 
 @dataclass
 class Agent:
@@ -88,13 +92,14 @@ def main():
       # Switch names to preserve old Fabric convention
       name = 'monitoring-deprecated'
 
+    is_primary = 'Primary service agent' in agent_text
     agent = Agent(
         name=name,
         display_name=col1.h4.get_text(),
         api=col1.span.code.get_text() if name != 'cloudservices' else None,
         identity=identity,
         role=col2.code.get_text() if 'roles/' in agent_text else None,
-        is_primary='Primary service agent' in agent_text,
+        is_primary=PRIMARY_OVERRIDE.get(name, is_primary),
         aliases=ALIASES.get(name, []),
     )