Google now allows GCP service accounts to be granted delegated admin status for a G Suite domain.
To use this, admins can grant the service account email address delegated admin rights in the admin console
and then set some environment variables for GAM to use:
OAUTHFILE=oauth2service.json
GA_DOMAIN=example.com # your primary domain name in Google
CUSTOMER_ID=1d80dfc # admin.google.com > Account > Account settings > Customer ID