{"record":{"id":"eef230b55eaddf4d","repo":"googleapis/mcp-toolbox","slug":"failed-to-create-impersonated-credentials-for-q-f","errorCode":null,"errorMessage":"failed to create impersonated credentials for %q for project %q: %w","messagePattern":"failed to create impersonated credentials for %q for project %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/dataplex/dataplex.go","lineNumber":209,"sourceCode":"\tif err != nil {\n\t\treturn nil, nil, nil, nil, err\n\t}\n\n\tvar opts []option.ClientOption\n\n\tcredScopes := scopes\n\tif len(credScopes) == 0 {\n\t\tcredScopes = []string{CloudPlatformScope}\n\t}\n\n\tif impersonateServiceAccount != \"\" {\n\t\t// Create impersonated credentials token source\n\t\tts, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{\n\t\t\tTargetPrincipal: impersonateServiceAccount,\n\t\t\tScopes:          credScopes,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn nil, nil, nil, nil, fmt.Errorf(\"failed to create impersonated credentials for %q for project %q: %w\", impersonateServiceAccount, project, err)\n\t\t}\n\t\topts = []option.ClientOption{\n\t\t\toption.WithUserAgent(userAgent),\n\t\t\toption.WithTokenSource(ts),\n\t\t}\n\t} else {\n\t\t// Use default credentials\n\t\tcred, err := google.FindDefaultCredentials(ctx, credScopes...)\n\t\tif err != nil {\n\t\t\treturn nil, nil, nil, nil, fmt.Errorf(\"failed to find default Google Cloud credentials for project %q: %w\", project, err)\n\t\t}\n\t\topts = []option.ClientOption{\n\t\t\toption.WithUserAgent(userAgent),\n\t\t\toption.WithCredentials(cred),\n\t\t}\n\t}\n\n\tclient, err := dataplexapi.NewCatalogClient(ctx, opts...)","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/dataplex/dataplex.go#L191-L227","documentation":"When `impersonateServiceAccount` is configured, the source creates an impersonated credential token source via golang.org/x/api/impersonate before building the Dataplex clients. This error wraps any failure of impersonate.CredentialsTokenSource, meaning a short-lived token could not be obtained for the target service account. All four client constructors later in initDataplexConnection depend on these options, so initialization aborts immediately.","triggerScenarios":"initDataplexConnection is called with a non-empty impersonateServiceAccount and impersonate.CredentialsTokenSource fails — invalid SA email, caller lacking roles/iam.serviceAccountTokenCreator on the target SA, IAM API disabled, or no default credentials to sign the initial request.","commonSituations":"Typo in the impersonateServiceAccount email in the toolbox YAML; the caller's identity lacks TokenCreator on the target SA; Workload Identity Federation setup where impersonation chain is misconfigured; iamcredentials.googleapis.com not enabled in the target project.","solutions":["Verify the impersonateServiceAccount email is correct and exists: `gcloud iam service-accounts describe <sa-email>`.","Grant the authenticated identity roles/iam.serviceAccountTokenCreator on the target SA: `gcloud iam service-accounts add-iam-policy-binding <sa-email> --member=... --role=roles/iam.serviceAccountTokenCreator`.","Enable the IAM Credentials API (iamcredentials.googleapis.com) in the project.","Ensure valid base credentials exist (`gcloud auth application-default login` or a proper ADC environment) before impersonation.","Add the cloud-platform scope availability check — confirm the base credentials can request the configured scopes."],"exampleFix":"// before\nimpersonateServiceAccount: my-sa@wrong-project.iam.gserviceaccount.com\n// after\nimpersonateServiceAccount: my-sa@correct-project.iam.gserviceaccount.com","handlingStrategy":"validation","validationCode":"gcloud iam service-accounts describe $SA_EMAIL >/dev/null && \\\n  gcloud iam service-accounts get-iam-policy $SA_EMAIL --flatten=\"bindings[].members\" --filter=\"bindings.role=roles/iam.serviceAccountTokenCreator\"","typeGuard":null,"tryCatchPattern":"src, err := cfg.Initialize(ctx, tracer)\nif err != nil {\n\tif strings.Contains(err.Error(), \"failed to create impersonated credentials\") {\n\t\tlog.Fatalf(\"impersonation setup failed; check SA email and TokenCreator role: %v\", err)\n\t}\n\treturn err\n}","preventionTips":["Verify the impersonateServiceAccount email against `gcloud iam service-accounts list`.","Grant your identity roles/iam.serviceAccountTokenCreator on the target SA.","Enable iamcredentials.googleapis.com in the SA's project.","Ensure base ADC exists before impersonation is attempted."],"tags":["gcp","iam","impersonation","dataplex","authentication"],"backgroundTag":"service-account-impersonation-failed","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}