CMEK Encryption Key in Google Cloud Storage

[irivai]

Hi there folks, i have googled for a while, and can't seem to find an answer.

So my question is: Can i use a user-managed service account, in purpose of using CMEK encryption for GCS? 

I coded using Go, even I hard-coded the credentials by exporting GOOGLE_APPLICATION_CREDENTIALS explicitly, still throws this error:

Failed to create object reader: googleapi: got HTTP response code 403 with body: <?xml version='1.0' encoding='UTF-8'?><Error><Code>AccessDenied</Code><Message>Permission denied on Cloud KMS key. Please ensure that your Cloud Storage service account has been authorized to use this key.</Message></Error>

^ this is deliberate, just want to verify what SA is being used, so I granted the GCS service-agent minimum role

Seems like it won't read the custom SA, always pinpointing to the role of the service agent inside the GCS.

the closest thread I could find is this that matched my use case : https://stackoverflow.com/questions/56320241/permission-denied-on-cloud-kms-key-when-using-cloud-sto... , but I guess no answer to that.

I was wondering, can this Cloud KMS Encrypt/Decrypt usage can be done using a custom Service Account (user created SA) or not?

Thanks.