getting error while api proxy deployment via pipeline (service account permission issue)

[sachinjobs85]

INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 6.345 s
[INFO] Finished at: 2023-05-02T18:35:33Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal io.apigee.build-tools.enterprise4g:apigee-edge-maven-plugin:2.2.2:deploy (deploy-bundle-step) on project xxxxxxxxxxx: : MojoExecutionException: com.google.api.client.http.HttpResponseException: 403 Forbidden
[ERROR] {
[ERROR] "error": {
[ERROR] "code": 403,
[ERROR] "message": "permission 'iam.serviceAccounts.actAs' denied on resource 'projects/-/serviceAccounts/xxxxxxxxxx@xxxxxxxxxx.iam.gserviceaccount.com' (or it may not exist in the project for Apigee org \"xxxxxxxxxx\")",
[ERROR] "status": "PERMISSION_DENIED",
[ERROR] "details": [
[ERROR] {
[ERROR] "@type": "type.googleapis.com/google.rpc.RequestInfo",
[ERROR] "requestId": "8723676112869934182"
[ERROR] }
[ERROR] ]
[ERROR] }
[ERROR] }



I have given all the required permission to service account but still getting the same error.

Permissions are below:

Actions Admin
Apigee API Admin
Apigee Integration Invoker
Apigee Organization Admin
Application Integration Invoker
Cloud Datastore User
Cloud Functions Invoker
Pub/Sub Publisher
Pub/Sub Subscriber
Secret Manager Secret Accessor
Service Account User

[Abhijeet1]

Hello,

The role that you shuld grant on a service account user should be one of the default Apigee-ones-https://cloud.google.com/apigee/docs/api-platform/system-administration/apigee-roles

After assignment you must enable that role in the Apigee UI's Environment Access view:

https://cloud.google.com/apigee/docs/api-platform/system-administration/users-roles-overview#role-re...

Also the service account is from same project or different one?

[Abhijeet1]

Hello,

The role that you shuld grant on a service account user should be one of the default Apigee-ones-https://cloud.google.com/apigee/docs/api-platform/system-administration/apigee-roles

After assignment you must enable that role in the Apigee UI's Environment Access view:

https://cloud.google.com/apigee/docs/api-platform/system-administration/users-roles-overview#role-re...

Also the service account is from same project or different one?