How to Resolve a GCP 403 Error for iam.serviceAccounts.actAs in a Cross-Project BigQuery Scheduled Query?

Below is an explanation of a likely cause and a potential resolution.

---

What's Happening

Even though you’ve granted the Service Account User role (which includes iam.serviceAccounts.actAs) on sa2 to sa1, the error indicates that the caller (sa1) isn’t allowed to “act as” sa2. When you create a scheduled query (which is backed by a transfer configuration) the BigQuery Data Transfer Service is involved. In many cases the creation process delegates impersonation to an internal service agent – meaning that although you’re impersonating sa1, the actual API call that checks the permissions for acting as sa2 comes from the transfer service agent.

---

What Might Be Missing

Because the operation is executed via the BigQuery Data Transfer Service, you also need to ensure that the service agent (for example, the account in your project with an email like:

  service-PROJECTNUMBER@gcp-sa-bigquerydatatransfer.iam.gserviceaccount.com

) has permission to act as sa2. In other words, while sa1 has iam.serviceAccounts.actAs on sa2, the transfer service actually needs that right as well. This is why the error appears even though your manual check suggests otherwise.

---

How to Fix

There are two possible fixes:

1. Grant the Needed Role to the Transfer Service Agent

   Grant the appropriate role (or simply the iam.serviceAccounts.actAs permission) to your transfer service agent on sa2. The recommended approach is to grant the Service Account User or Service Account Token Creator role on sa2 for the transfer service agent. For example, using gcloud you might run (adjusting for your project numbers):

   BASHCopied
   gcloud iam service-accounts add-iam-policy-binding \
     sa2@project2.iam.gserviceaccount.com \
     --member="serviceAccount:service-PROJECT1_NUMBER@gcp-sa-bigquerydatatransfer.iam.gserviceaccount.com" \
     --role="roles/iam.serviceAccountTokenCreator"

   Note: In some cases, the Service Account User role is used, but if you’d prefer to narrow the permissions, the Token Creator role might be sufficient.

2. Use a Same-Project Service Account

   Alternatively, if possible, consider using a service account from the same project as the scheduled query (or Data Transfer Service configuration) so that the cross-project impersonation step is not required. This approach avoids the complications related to cross-project service account impersonation.

---

Final Note

The error message can be misleading in scenarios where a backend service (like the BigQuery Data Transfer Service) is also performing impersonation. Adjusting the IAM binding to include all principals involved in the delegated call should clear the error.

By granting the transfer service agent the proper iam.serviceAccounts.actAs (or Service Account Token Creator) permission to act as sa2, your scheduled query creation should work as expected.