def _service_account_id(project):
  """Return service account ID for project."""
  # From
  # cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/create:
  #
  # The account id that is used to generate the service account email address
  # and a stable unique id. It is unique within a project, must be 6-30
  # characters long, and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])
  # to comply with RFC1035.
  min_len = 6
  max_len = 30

  account_id = 'bot-' + project.replace('_', '-')
  if not account_id[-1].isalnum():
    # Must end in '[a-z][0-9]'.
    account_id += '0'

  if len(account_id) < min_len:
    # Must be at least |min_len| in length.
    account_id = account_id.ljust(min_len, '0')

  assert len(account_id) >= min_len and len(account_id) <= max_len
  return account_id