Permission to create services using Workload Identity Pools

[jamescrosswell]

I currently have a service configured in Cloud Run and a GitHub Action that builds a docker container, pushes this to the Google Artifact Registry and deploys this to the service.

In addition to deploying new versions of existing cloud run services though, I need the to be able to create new services from GitHub Actions... and I can't see how to create the IAM policy binding for that. 

This let's me add permission for a service that already exists:
gcloud run services add-iam-policy-binding SERVICE --member-PRINCIPAL --role=ROLE

How can I give that principal permission to create new services though?