googleapis/mcp-toolbox · error

failed to create impersonated credentials for %q for project

Error message

failed to create impersonated credentials for %q for project %q: %w

What it means

When `impersonateServiceAccount` is configured, the source creates an impersonated credential token source via golang.org/x/api/impersonate before building the Dataplex clients. This error wraps any failure of impersonate.CredentialsTokenSource, meaning a short-lived token could not be obtained for the target service account. All four client constructors later in initDataplexConnection depend on these options, so initialization aborts immediately.

Source

Thrown at internal/sources/dataplex/dataplex.go:209

	if err != nil {
		return nil, nil, nil, nil, err
	}

	var opts []option.ClientOption

	credScopes := scopes
	if len(credScopes) == 0 {
		credScopes = []string{CloudPlatformScope}
	}

	if impersonateServiceAccount != "" {
		// Create impersonated credentials token source
		ts, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{
			TargetPrincipal: impersonateServiceAccount,
			Scopes:          credScopes,
		})
		if err != nil {
			return nil, nil, nil, nil, fmt.Errorf("failed to create impersonated credentials for %q for project %q: %w", impersonateServiceAccount, project, err)
		}
		opts = []option.ClientOption{
			option.WithUserAgent(userAgent),
			option.WithTokenSource(ts),
		}
	} else {
		// Use default credentials
		cred, err := google.FindDefaultCredentials(ctx, credScopes...)
		if err != nil {
			return nil, nil, nil, nil, fmt.Errorf("failed to find default Google Cloud credentials for project %q: %w", project, err)
		}
		opts = []option.ClientOption{
			option.WithUserAgent(userAgent),
			option.WithCredentials(cred),
		}
	}

	client, err := dataplexapi.NewCatalogClient(ctx, opts...)

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Verify the impersonateServiceAccount email is correct and exists: `gcloud iam service-accounts describe <sa-email>`.
2. Grant the authenticated identity roles/iam.serviceAccountTokenCreator on the target SA: `gcloud iam service-accounts add-iam-policy-binding <sa-email> --member=... --role=roles/iam.serviceAccountTokenCreator`.
3. Enable the IAM Credentials API (iamcredentials.googleapis.com) in the project.
4. Ensure valid base credentials exist (`gcloud auth application-default login` or a proper ADC environment) before impersonation.
5. Add the cloud-platform scope availability check — confirm the base credentials can request the configured scopes.

Example fix

// before
impersonateServiceAccount: my-sa@wrong-project.iam.gserviceaccount.com
// after
impersonateServiceAccount: my-sa@correct-project.iam.gserviceaccount.com

gcloud iam service-accounts describe $SA_EMAIL >/dev/null && \
  gcloud iam service-accounts get-iam-policy $SA_EMAIL --flatten="bindings[].members" --filter="bindings.role=roles/iam.serviceAccountTokenCreator"

src, err := cfg.Initialize(ctx, tracer)
if err != nil {
	if strings.Contains(err.Error(), "failed to create impersonated credentials") {
		log.Fatalf("impersonation setup failed; check SA email and TokenCreator role: %v", err)
	}
	return err
}

When it happens

Trigger: initDataplexConnection is called with a non-empty impersonateServiceAccount and impersonate.CredentialsTokenSource fails — invalid SA email, caller lacking roles/iam.serviceAccountTokenCreator on the target SA, IAM API disabled, or no default credentials to sign the initial request.

Common situations: Typo in the impersonateServiceAccount email in the toolbox YAML; the caller's identity lacks TokenCreator on the target SA; Workload Identity Federation setup where impersonation chain is misconfigured; iamcredentials.googleapis.com not enabled in the target project.

Related errors

• failed to create impersonated credentials for %q: %w
• error getting email from ADC: %v
• failed to initialize dataplex client: %w
• failed to get dataplex client: %w
• unable to create instance admin client: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/eef230b55eaddf4d. Report an issue: GitHub.