failed to create impersonated credentials for

Error message

failed to create impersonated credentials for %q for project %q: %w

What it means

When `impersonateServiceAccount` is configured, the source creates an impersonated credential token source via golang.org/x/api/impersonate before building the Dataplex clients. This error wraps any failure of impersonate.CredentialsTokenSource, meaning a short-lived token could not be obtained for the target service account. All four client constructors later in initDataplexConnection depend on these options, so initialization aborts immediately.

Solutions

Verify the impersonateServiceAccount email is correct and exists: `gcloud iam service-accounts describe <sa-email>`.
Grant the authenticated identity roles/iam.serviceAccountTokenCreator on the target SA: `gcloud iam service-accounts add-iam-policy-binding <sa-email> --member=... --role=roles/iam.serviceAccountTokenCreator`.
Enable the IAM Credentials API (iamcredentials.googleapis.com) in the project.
Ensure valid base credentials exist (`gcloud auth application-default login` or a proper ADC environment) before impersonation.
Add the cloud-platform scope availability check — confirm the base credentials can request the configured scopes.

Example fix

// before
impersonateServiceAccount: my-sa@wrong-project.iam.gserviceaccount.com
// after
impersonateServiceAccount: my-sa@correct-project.iam.gserviceaccount.com

Defensive patterns

Strategy: validation

Validate before calling

gcloud iam service-accounts describe $SA_EMAIL >/dev/null && \
  gcloud iam service-accounts get-iam-policy $SA_EMAIL --flatten="bindings[].members" --filter="bindings.role=roles/iam.serviceAccountTokenCreator"

Try / catch

src, err := cfg.Initialize(ctx, tracer)
if err != nil {
	if strings.Contains(err.Error(), "failed to create impersonated credentials") {
		log.Fatalf("impersonation setup failed; check SA email and TokenCreator role: %v", err)
	}
	return err
}

Prevention

Verify the impersonateServiceAccount email against `gcloud iam service-accounts list`.
Grant your identity roles/iam.serviceAccountTokenCreator on the target SA.
Enable iamcredentials.googleapis.com in the SA's project.
Ensure base ADC exists before impersonation is attempted.

When it happens

Trigger: initDataplexConnection is called with a non-empty impersonateServiceAccount and impersonate.CredentialsTokenSource fails — invalid SA email, caller lacking roles/iam.serviceAccountTokenCreator on the target SA, IAM API disabled, or no default credentials to sign the initial request.

Common situations: Typo in the impersonateServiceAccount email in the toolbox YAML; the caller's identity lacks TokenCreator on the target SA; Workload Identity Federation setup where impersonation chain is misconfigured; iamcredentials.googleapis.com not enabled in the target project.

Related errors

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/eef230b55eaddf4d. Report an issue: GitHub.

Appendix: source

Thrown at internal/sources/dataplex/dataplex.go:209

	if err != nil {
		return nil, nil, nil, nil, err
	}

	var opts []option.ClientOption

	credScopes := scopes
	if len(credScopes) == 0 {
		credScopes = []string{CloudPlatformScope}
	}

	if impersonateServiceAccount != "" {
		// Create impersonated credentials token source
		ts, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{
			TargetPrincipal: impersonateServiceAccount,
			Scopes:          credScopes,
		})
		if err != nil {
			return nil, nil, nil, nil, fmt.Errorf("failed to create impersonated credentials for %q for project %q: %w", impersonateServiceAccount, project, err)
		}
		opts = []option.ClientOption{
			option.WithUserAgent(userAgent),
			option.WithTokenSource(ts),
		}
	} else {
		// Use default credentials
		cred, err := google.FindDefaultCredentials(ctx, credScopes...)
		if err != nil {
			return nil, nil, nil, nil, fmt.Errorf("failed to find default Google Cloud credentials for project %q: %w", project, err)
		}
		opts = []option.ClientOption{
			option.WithUserAgent(userAgent),
			option.WithCredentials(cred),
		}
	}

	client, err := dataplexapi.NewCatalogClient(ctx, opts...)

View on GitHub (pinned to 8cc6e09de2)