{"record":{"id":"1451ecbc76cbfb2d","repo":"googleapis/mcp-toolbox","slug":"failed-to-create-impersonated-credentials-for-q","errorCode":null,"errorMessage":"failed to create impersonated credentials for %q: %w","messagePattern":"failed to create impersonated credentials for %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/bigquery/bigquery.go","lineNumber":788,"sourceCode":"\n\tvar credScopes []string\n\tif len(scopes) > 0 {\n\t\tcredScopes = scopes\n\t} else if impersonateServiceAccount != \"\" {\n\t\tcredScopes = []string{CloudPlatformScope}\n\t} else {\n\t\tcredScopes = []string{bigqueryapi.Scope}\n\t}\n\n\tif impersonateServiceAccount != \"\" {\n\t\t// Create impersonated credentials token source\n\t\t// This broader scope is needed for tools like conversational analytics\n\t\tcloudPlatformTokenSource, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{\n\t\t\tTargetPrincipal: impersonateServiceAccount,\n\t\t\tScopes:          credScopes,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn nil, nil, nil, fmt.Errorf(\"failed to create impersonated credentials for %q: %w\", impersonateServiceAccount, err)\n\t\t}\n\t\ttokenSource = cloudPlatformTokenSource\n\t\topts = []option.ClientOption{\n\t\t\toption.WithUserAgent(userAgent),\n\t\t\toption.WithTokenSource(cloudPlatformTokenSource),\n\t\t}\n\t} else {\n\t\t// Use default credentials\n\t\tcred, err := google.FindDefaultCredentials(ctx, credScopes...)\n\t\tif err != nil {\n\t\t\treturn nil, nil, nil, fmt.Errorf(\"failed to find default Google Cloud credentials with scopes %v: %w\", credScopes, err)\n\t\t}\n\t\ttokenSource = cred.TokenSource\n\t\topts = []option.ClientOption{\n\t\t\toption.WithUserAgent(userAgent),\n\t\t\toption.WithCredentials(cred),\n\t\t}\n\t}","sourceCodeStart":770,"sourceCodeEnd":806,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/bigquery/bigquery.go#L770-L806","documentation":"This error is thrown when the service-account impersonation flow fails: the library calls impersonate.CredentialsTokenSource to obtain a token source on behalf of the configured impersonateServiceAccount, using the cloud-platform scope (needed for tools like conversational analytics). If the underlying iamcredentials.generateAccessToken call or credential resolution fails, the error is wrapped with the target service account name. Common wrapped causes include missing IAM permissions and unreachable token endpoint.","triggerScenarios":"The BigQuery source is configured with an impersonate_service_account, and impersonate.CredentialsTokenSource fails because the base credentials cannot call iamcredentials.generateAccessToken on the target principal (roles/iam.serviceAccountTokenCreator missing), the target service account does not exist/disabled, or the base credentials lack a valid token source.","commonSituations":"Misconfigured service account email (typo, wrong project); missing roles/iam.serviceAccountTokenCreator on the caller; disabled or deleted service account; running locally without gcloud ADC while impersonation is configured; org policies blocking token creation.","solutions":["Grant the calling identity roles/iam.serviceAccountTokenCreator on the target service account.","Verify the impersonateServiceAccount email is correct and the account exists and is enabled.","Ensure valid base credentials (Application Default Credentials) are available for the caller.","Check org policy constraints that block IAM credential generation; inspect the wrapped error with errors.As for googleapi.Error codes."],"exampleFix":"// before (my-sdk.yaml)\nsources:\n  my-bq:\n    kind: bigquery\n    project: my-project\n    impersonateServiceAccount: bq-reader@proj.iam.gserviceaccount.com\n// after: first grant permission, then use the correct account\ngcloud iam service-accounts add-iam-policy-binding \\\n  bq-reader@proj.iam.gserviceaccount.com \\\n  --member=\"user:dev@example.com\" --role=\"roles/iam.serviceAccountTokenCreator\"","handlingStrategy":"validation","validationCode":"// Verify impersonation prerequisites before startup\ntarget := \"bq-reader@proj.iam.gserviceaccount.com\"\nout, err := exec.Command(\"gcloud\", \"iam\", \"service-accounts\", \"describe\", target).CombinedOutput()\nif err != nil {\n  return fmt.Errorf(\"impersonation target %s missing or inaccessible: %v: %s\", target, err, out)\n}\ncaller, _ := exec.Command(\"gcloud\", \"config\", \"get-value\", \"account\").Output()\ncheck, _ := exec.Command(\"gcloud\", \"projects\", \"get-iam-policy\", \"proj\",\n  \"--flatten=bindings\",\n  \"--filter=bindings.role:roles/iam.serviceAccountTokenCreator\").CombinedOutput()\nif !strings.Contains(string(check), string(bytes.TrimSpace(caller))) {\n  return fmt.Errorf(\"caller %s lacks roles/iam.serviceAccountTokenCreator on %s\", caller, target)\n}","typeGuard":null,"tryCatchPattern":"// Go\nclient, rest, ts, err := initBigQueryConnection(ctx, cfg)\nif err != nil && strings.Contains(err.Error(), \"failed to create impersonated credentials\") {\n  log.Fatalf(\"impersonation failed for %v: %v — check serviceAccountTokenCreator role and ADC\", cfg.ImpersonateServiceAccount, err)\n}","preventionTips":["Grant roles/iam.serviceAccountTokenCreator on the target account to the calling identity.","Run 'gcloud auth application-default login' locally before enabling impersonation.","Verify the impersonateServiceAccount email with 'gcloud iam service-accounts describe'.","Keep the service account enabled and check org policies restricting token generation."],"tags":["bigquery","gcp","iam","impersonation","authentication"],"backgroundTag":"impersonated-credentials-failed","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}