def _iam_ident_to_email(ident):
  """Given IAM identity returns email address or None."""
  for p in ('user:', 'serviceAccount:'):
    if ident.startswith(p):
      return ident[len(p):]
  return None