Error: checking service account permission

[GRII]

I've been using google cloud for a good many years. This issue is new to me and would like to get help from the community.

The problem arose when trying to submit a job through a service account, and got encountered with this error message below. This is after everything worked smoothly in the past.

After digging around and finding service account role bindings: it turns out that the account used to call the service account has the role setup properly (re-bound, just to be sure), with "role: roles/iam.serviceAccountUser". 

Things should work, what and where went wrong?

Another account in the same project works fine to submit jobs through the same service account, so that part is fine. It only affects this specific account.

One thing might be related is the google_compute_engine public key for the affected account has been refreshed. My understanding is it is only used to remote access VM on GCP. I am not sure whether it is related to job submission through Life Sciences API. If it is related, how do I get the new public key gets recognized and updated?

Error message:
... googleapiclient.errors.HttpError: <HttpError 403 when requesting https://genomics.googleapis.com/v2alpha1/pipelines:run?alt=json returned "Error: checking service account permission: caller does not have access to act as the specified service account: .....compute@developer.gserviceaccount.com"". Details: "Error: checking service account permission: caller does not have access to act as the specified service account: "........compute@developer.gserviceaccount.com"">

[GRII]

Here are all the steps had been tried (still didn't solve the problem):

• revoked affected account (gcloud auth revoke) and re-authorized
• gcloud sdk is up-to-date
• service account user role had been revoked and reassigned at project-level, and also service account-specifically.

Any thoughts and directions I should try next??

[GRII]

Tried a different step:

On the computer it is affected, there is a different account logged in concurrently. After switching to that account, when tried to submit jobs, this is also affected, while it doesn't have such issue before.

This is suggesting that whatever is been impacted, it is as computer level, not account specific. What can cause multiple accounts so that they lost access to their distinct service accounts all at once, which they still have the role assigned properly?

Was google_compute_engine.pub under .ssh folder related with this? 

[GRII · Accepted solution]

Got to the bottom of this.

Regardless whatever happened, the problem is gone after revoking gcloud application-default and re-login.

gcloud auth application-default revoke

gcloud auth application-default login

now everything is back to normal.