googleapis/mcp-toolbox · error

failed to create impersonated credentials for %q: %w

Error message

failed to create impersonated credentials for %q: %w

What it means

This error is thrown when the service-account impersonation flow fails: the library calls impersonate.CredentialsTokenSource to obtain a token source on behalf of the configured impersonateServiceAccount, using the cloud-platform scope (needed for tools like conversational analytics). If the underlying iamcredentials.generateAccessToken call or credential resolution fails, the error is wrapped with the target service account name. Common wrapped causes include missing IAM permissions and unreachable token endpoint.

Source

Thrown at internal/sources/bigquery/bigquery.go:788

	var credScopes []string
	if len(scopes) > 0 {
		credScopes = scopes
	} else if impersonateServiceAccount != "" {
		credScopes = []string{CloudPlatformScope}
	} else {
		credScopes = []string{bigqueryapi.Scope}
	}

	if impersonateServiceAccount != "" {
		// Create impersonated credentials token source
		// This broader scope is needed for tools like conversational analytics
		cloudPlatformTokenSource, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{
			TargetPrincipal: impersonateServiceAccount,
			Scopes:          credScopes,
		})
		if err != nil {
			return nil, nil, nil, fmt.Errorf("failed to create impersonated credentials for %q: %w", impersonateServiceAccount, err)
		}
		tokenSource = cloudPlatformTokenSource
		opts = []option.ClientOption{
			option.WithUserAgent(userAgent),
			option.WithTokenSource(cloudPlatformTokenSource),
		}
	} else {
		// Use default credentials
		cred, err := google.FindDefaultCredentials(ctx, credScopes...)
		if err != nil {
			return nil, nil, nil, fmt.Errorf("failed to find default Google Cloud credentials with scopes %v: %w", credScopes, err)
		}
		tokenSource = cred.TokenSource
		opts = []option.ClientOption{
			option.WithUserAgent(userAgent),
			option.WithCredentials(cred),
		}
	}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Grant the calling identity roles/iam.serviceAccountTokenCreator on the target service account.
2. Verify the impersonateServiceAccount email is correct and the account exists and is enabled.
3. Ensure valid base credentials (Application Default Credentials) are available for the caller.
4. Check org policy constraints that block IAM credential generation; inspect the wrapped error with errors.As for googleapi.Error codes.

Example fix

// before (my-sdk.yaml)
sources:
  my-bq:
    kind: bigquery
    project: my-project
    impersonateServiceAccount: bq-reader@proj.iam.gserviceaccount.com
// after: first grant permission, then use the correct account
gcloud iam service-accounts add-iam-policy-binding \
  bq-reader@proj.iam.gserviceaccount.com \
  --member="user:dev@example.com" --role="roles/iam.serviceAccountTokenCreator"

// Verify impersonation prerequisites before startup
target := "bq-reader@proj.iam.gserviceaccount.com"
out, err := exec.Command("gcloud", "iam", "service-accounts", "describe", target).CombinedOutput()
if err != nil {
  return fmt.Errorf("impersonation target %s missing or inaccessible: %v: %s", target, err, out)
}
caller, _ := exec.Command("gcloud", "config", "get-value", "account").Output()
check, _ := exec.Command("gcloud", "projects", "get-iam-policy", "proj",
  "--flatten=bindings",
  "--filter=bindings.role:roles/iam.serviceAccountTokenCreator").CombinedOutput()
if !strings.Contains(string(check), string(bytes.TrimSpace(caller))) {
  return fmt.Errorf("caller %s lacks roles/iam.serviceAccountTokenCreator on %s", caller, target)
}

// Go
client, rest, ts, err := initBigQueryConnection(ctx, cfg)
if err != nil && strings.Contains(err.Error(), "failed to create impersonated credentials") {
  log.Fatalf("impersonation failed for %v: %v — check serviceAccountTokenCreator role and ADC", cfg.ImpersonateServiceAccount, err)
}

When it happens

Trigger: The BigQuery source is configured with an impersonate_service_account, and impersonate.CredentialsTokenSource fails because the base credentials cannot call iamcredentials.generateAccessToken on the target principal (roles/iam.serviceAccountTokenCreator missing), the target service account does not exist/disabled, or the base credentials lack a valid token source.

Common situations: Misconfigured service account email (typo, wrong project); missing roles/iam.serviceAccountTokenCreator on the caller; disabled or deleted service account; running locally without gcloud ADC while impersonation is configured; org policies blocking token creation.

Related errors

• failed to create impersonated credentials for %q for project
• error getting email from ADC: %v
• failed to find default Google Cloud credentials with scopes
• unable to create instance admin client: %w
• useClientOAuth cannot be used with impersonateServiceAccount

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/1451ecbc76cbfb2d. Report an issue: GitHub.