Permission denied when creating GCP Service Account Key

Question

I've created Service Account A and granted roles Service Account Admin and Service Account Key Admin. I did this work in the GCP Console.

Service Account A's function is to create other service accounts programmatically, using the GCP Java SDK. It successfully creates new service accounts, but when it goes to create a key for the newly created service account, I get the following response:

{
  "code": 403,
  "errors": [
    {
      "domain": "global",
      "message": "Permission iam.serviceAccountKeys.create is required to perform this operation on service account projects/-/serviceAccounts/<new_service_account_name>@<project_id>.iam.gserviceaccount.com.",
      "reason": "forbidden"
    }
  ],
  "message": "Permission iam.serviceAccountKeys.create is required to perform this operation on service account projects/-/serviceAccounts/<new_service_account_name>@<project_id>.iam.gserviceaccount.com.",
  "status": "PERMISSION_DENIED"
}

I've tried waiting to see if perhaps I tried to create the key too soon after creating the service account, but waiting hours resulted in no change.

Service Account A can successfully create a key for itself, just not for other service accounts it creates.

How do I resolve?

Answer 1

You have one of three problems:

1. Service Account A actually does not have the IAM role Service Account Key Admin in the project. Use the CLI command gcloud projects get-iam-policy and double-check.

2. Your code is using the wrong identity. You believe that you are using the service account but instead, another identity is being loaded by ADC (Application Default Credentials), or you made a mistake in your code.

3. You assign the correct role but on the service account instead of the project. Use the CLI command gcloud iam service-accounts get-iam-policy. If you find the role listed in the output, you assigned the role in the wrong place. Use the CLI command gcloud projects add-iam-policy-binding instead.

Note: There is a fourth method to prevent you from creating service account keys. Constraints might be enabled:

Restricting service account usage