Unable to use Service Account from different project

[igrikus]

I'm trying to run a Batch job in Project-A with a custom Service Account from Project-B. In both projects, my user has `roles/iam.serviceAccountUser` role specified. But when I submit a job (using gcloud, or Java SDK) I get an error:

PERMISSION_DENIED: caller does not have access to act as the specified service account: "my-sa@project-b.iam.gserviceaccount.com"

What I tried:

• Steps from the troubleshooting guide with exact error match
• All sorts of permission combinations, even including Service Agents modification

Using accounts from the same project (Project-A) does not cause any errors and the batch job runs correctly. The error occurs only when using an account from another project

[mokit · Accepted solution]

Hi, @igrikus.

In your scenario, you're using a single service account across both projects which is related to cross-project service account privileges. Have you already reviewed the relevant documentation (Support a cross-project service account) for this? If not, please follow the steps outlined in the instructions provided there.

Regards,
Mokit

[igrikus]

Thank you for the tip, @mokit !
Now it works, here is what I did:

1. Turned off `iam.disableCrossProjectServiceAccountUsage` policy in the parent project
2. Added `roles/iam.serviceAccountUser` for the Batch service agent from Project-A to my Service Account from project-B

[mokit]

Glad to hear that it resolved your issue 🎉