{"record":{"id":"7d57b7d1d66f1a94","repo":"apache/iceberg","slug":"failed-to-create-impersonated-credentials-for-im","errorCode":null,"errorMessage":"Failed to create impersonated credentials for ${impersonateServiceAccount}","messagePattern":"Failed to create impersonated credentials for (.+?)","errorType":"exception","errorClass":"UncheckedIOException","httpStatus":null,"severity":"error","filePath":"bigquery/src/main/java/org/apache/iceberg/gcp/bigquery/BigQueryProperties.java","lineNumber":193,"sourceCode":"  }\n\n  private ImpersonatedCredentials buildImpersonatedCredentials() {\n    try {\n      GoogleCredentials sourceCredentials = GoogleCredentials.getApplicationDefault();\n\n      ImpersonatedCredentials impersonatedCredentials =\n          ImpersonatedCredentials.create(\n              sourceCredentials, impersonateServiceAccount, delegates, scopes, lifetimeSeconds);\n\n      // refresh to validate credentials and get initial token\n      impersonatedCredentials.refresh();\n\n      LOG.debug(\n          \"Created impersonated credentials for BigQuery: Target={}\", impersonateServiceAccount);\n\n      return impersonatedCredentials;\n    } catch (IOException e) {\n      throw new UncheckedIOException(\n          \"Failed to create impersonated credentials for \" + impersonateServiceAccount, e);\n    }\n  }\n}\n","sourceCodeStart":175,"sourceCodeEnd":198,"githubUrl":"https://github.com/apache/iceberg/blob/86d9c8fc543e7c56c9f624eb725f76c9baff9570/bigquery/src/main/java/org/apache/iceberg/gcp/bigquery/BigQueryProperties.java#L175-L198","documentation":"buildImpersonatedCredentials wraps the IOException from obtaining the source Application Default Credentials (or from the token exchange) into an UncheckedIOException naming the target service account. It is thrown when the base credentials needed to impersonate `impersonateServiceAccount` cannot be loaded or the impersonation flow fails.","triggerScenarios":"metastoreOptions is configured with an impersonation service account but GoogleCredentials.getApplicationDefault() fails (no ADC), or the ImpersonatedCredentials creation fails due to invalid source credentials.","commonSituations":"Setting the impersonation service-account property without valid base ADC; running off-GCP with no metadata server; the credentials file for the source identity is missing or malformed.","solutions":["Ensure base ADC is available: `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS to a valid key file.","Verify the impersonated service account exists and the source identity has roles/iam.serviceAccountTokenCreator on it.","Check network reachability to the IAM credentials token endpoint.","Drop impersonation config if base credentials cannot be fixed, and authenticate directly."],"exampleFix":"// before\nprops.put(\"gcp.bigquery.impersonate-service-account\", \"sa@project.iam.gserviceaccount.com\"); // no ADC set\n// after\nexport GOOGLE_APPLICATION_CREDENTIALS=/path/to/source-sa.json\nprops.put(\"gcp.bigquery.impersonate-service-account\", \"sa@project.iam.gserviceaccount.com\");","handlingStrategy":"validation","validationCode":"boolean ready;\ntry {\n  GoogleCredentials.getApplicationDefault();\n  ready = true;\n} catch (IOException e) {\n  ready = false;\n}\nif (impersonationConfigured && !ready) {\n  throw new IllegalStateException(\"Impersonation requires valid base ADC; configure GOOGLE_APPLICATION_CREDENTIALS first\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  metastoreOptions();\n} catch (UncheckedIOException e) {\n  throw new IllegalStateException(\"Impersonated credentials failed for target SA: \" + e.getCause().getMessage(), e);\n}","preventionTips":["Grant roles/iam.serviceAccountTokenCreator on the target SA to the base identity before enabling impersonation","Verify base ADC works before layering impersonation config on top","Test the token exchange with `gcloud auth print-identity-token` or a small IAM client probe","Keep the impersonated SA email exactly correct (project.iam.gserviceaccount.com)"],"tags":["gcp","authentication","impersonation","bigquery"],"backgroundTag":"oauth-token-exchange-failed","analyzedSha":"86d9c8fc543e7c56c9f624eb725f76c9baff9570","analyzedAt":"2026-09-12T00:46:39.097Z","contentChangedAt":"2026-09-12T00:46:39.097Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}