ERROR: (gcloud.composer.environments.update) Failed to impersonate when terraform runs impersonating as a second account

Question

I am getting the following error (Please see below) when I run my terraform apply.

I am running Terraform 12.x.

GCP Cloud Build runs in a different project other than project-abcd (where these accounts are)

My terraform code tries execute a gcloud command in a GCP cloud build container. It does so by impersonating as composer-bq-sa@prj-abcd.iam.gserviceaccount.com

The service account that terraform runs as is: terraform_service_account = "org-terraform@abcd.iam.gserviceaccount.com" (before impersonating)

This IAM account (org-terraform@abcd.iam.gserviceaccount.com) (NOT service account) has the following role bindings (TOTAL 9): (There is no Service Account with that email)

Composer Administrator
Compute Network Admin
Service Account Token Creator
Owner
Access Context Manager Admin
Security Admin
Service Account Admin
Logs Configuration Writer
Security Center Notification Configurations Editor

The service account (composer-bq-sa@prj-abcd.iam.gserviceaccount.com) has as one of its members: org-terraform@abcd.iam.gserviceaccount.com When I look at the screen titled "Members with access to this service account" and look at org-terraform@abcd.iam.gserviceaccount.com , I see that it has the following role-bindings (ONLY 4):

Service Account Token Creator
Owner
Security Admin
Service Account Admin

Why am I getting the error below even though IAM account has apparently the right roles and it is one of the members of the service account it is impersonating as?

ERROR

module.gcloud_composer_bucket_env_var.null_resource.run_command[0] (local-exec): WARNING: This command 
is using service account impersonation. All API calls will be executed as [**composer-bq-sa@prj-abcd.iam.gserviceaccount.com**].
module.gcloud_composer_bucket_env_var.null_resource.run_command[0] (local-exec): ERROR: 
(gcloud.composer.environments.update) Failed to impersonate [**composer-bq-sa@prj-abcd.iam.gserviceaccount.com**]. Make sure the account that's trying to impersonate it has access to the service account itself and the "roles/iam.serviceAccountTokenCreator" role.

Answer 1

Recapping:
In order to grant user permission to impersonate a Service Account follow instructions listed in this document.
Depending on the use case, you may grant user following roles:

• roles/iam.serviceAccountUser
• roles/iam.serviceAccountTokenCreator
• roles/iam.workloadIdentityUser