Looker Studio's service agent is missing "iam.serviceAccount.getAccessToken"

I have followed the setup steps in official docs.

1. Created a service account (say A) and grant 'Service Account Token Creator' role to it.
2. Added looker studio service agent (say B) to A's principal list and grant 'Service Account User' role to it.
 
But when I went back to looker studio and use A to connect to bigquery table, I still got Looker Studio's service agent is missing "iam.serviceAccount.getAccessToken" permission error.
I really appreciate it if someone can point out what else did I miss.

I am constantly getting the following error when trying to add a service account in looker studio. Looker Studio's service agent is missing "iam.serviceAccount.getAccessToken" permission for this service account. Learn how to fix this

2 9 2,120