Unable to use Service Account from different project

Google Cloud Compute Infrastructure
1

I’m trying to run a Batch job in Project-A with a custom Service Account from Project-B. In both projects, my user has roles/iam.serviceAccountUser role specified. But when I submit a job (using gcloud, or Java SDK) I get an error:

PERMISSION_DENIED: caller does not have access to act as the specified service account: "my-sa@project-b.iam.gserviceaccount.com"

What I tried:

  • Steps from the troubleshooting guide with exact error match
  • All sorts of permission combinations, even including Service Agents modification

Using accounts from the same project (Project-A) does not cause any errors and the batch job runs correctly. The error occurs only when using an account from another project

2

Hi, @igrikus .

In your scenario, you’re using a single service account across both projects which is related to cross-project service account privileges. Have you already reviewed the relevant documentation (Support a cross-project service account) for this? If not, please follow the steps outlined in the instructions provided there.

Regards,
Mokit

1 Like
3

Thank you for the tip, @mokit !
Now it works, here is what I did:

  1. Turned off iam.disableCrossProjectServiceAccountUsage policy in the parent project
  2. Added roles/iam.serviceAccountUser for the Batch service agent from Project-A to my Service Account from project-B
1 Like
4

Glad to hear that it resolved your issue :tada: