Google Cloud - what permissions does the service account require?

[aSemy]

I have successfully set up Lego (through Traefik) and I have a correct LetsEncrypt certificate.

Using io-sgr/google-ddns as inspiration, I created a service account with these permissions:

1. dns.changes.create
2. dns.changes.get
3. dns.changes.list
4. dns.dnsKeys.get
5. dns.dnsKeys.list
6. dns.managedZoneOperations.get
7. dns.managedZoneOperations.list
8. dns.managedZones.get
9. dns.managedZones.list
10. dns.managedZones.update
11. dns.projects.get
12. dns.resourceRecordSets.create
13. dns.resourceRecordSets.delete
14. dns.resourceRecordSets.list
15. dns.resourceRecordSets.update
16. resourcemanager.projects.get

Are these permissions sufficient, or are there too few or too many?

The documentation page doesn't elaborate.

Thanks!