OIDC GCP "Unable to acquire impersonated credentials" in CI

By Daniel Zoghalchali·Latchkey

google-github-actions/auth exchanged the OIDC token for a federated identity but could not impersonate the target service account. The provider attribute condition or the IAM binding on the service account does not permit this repository.

What this error means

The auth step fails with "Unable to acquire impersonated credentials" and a permission-denied detail for the service account. The OIDC exchange itself succeeded.

Error: google-github-actions/auth failed with: failed to generate
Google Cloud federated token ... Unable to acquire impersonated credentials:
... PERMISSION_DENIED

Diagnose it: what token do you actually have?

Permission failures in Actions are almost never about your repository settings alone. Three things combine: the default GITHUB_TOKEN permission set for the repo or organization, the permissions: block in the workflow, and whether the event is a fork pull request, which downgrades the token to read-only regardless of everything else.

- name: Show the token scopes actually granted
  run: |
    curl -sI -H "Authorization: Bearer $GITHUB_TOKEN" \
      https://api.github.com/ | grep -i "^x-oauth-scopes\|^x-accepted"
    echo "event: ${{ github.event_name }}"
    echo "fork PR: ${{ github.event.pull_request.head.repo.fork }}"
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Common causes

The service account lacks the workloadIdentityUser binding

The GitHub principal is not granted roles/iam.workloadIdentityUser on the service account, so impersonation is denied.

The provider attribute condition rejects the repo

The WIF provider's attribute mapping or condition (for example on assertion.repository) does not match this repo, blocking the exchange.

How to fix it

Bind the GitHub principal to the service account

1. Grant roles/iam.workloadIdentityUser on the service account to the WIF principalSet for your repo.
2. Confirm the provider attribute condition allows assertion.repository.
3. Re-run the auth step.

gcloud iam service-accounts add-iam-policy-binding \
  gha@PROJECT.iam.gserviceaccount.com \
  --role roles/iam.workloadIdentityUser \
  --member "principalSet://iam.googleapis.com/projects/NUM/locations/global/workloadIdentityPools/POOL/attribute.repository/my-org/my-repo"

Pass the correct provider and service account

Reference the full provider resource name and the service account to impersonate in the action.

- uses: google-github-actions/auth@v2
  with:
    workload_identity_provider: projects/NUM/locations/global/workloadIdentityPools/POOL/providers/PROVIDER
    service_account: gha@PROJECT.iam.gserviceaccount.com

Grant the narrowest permission that works

Declaring a permissions: block switches the job from the repository default to exactly what you list, so an incomplete block is a common cause of a new failure right after someone tightened security. List every scope the job needs, not just the one that failed.

permissions:
  contents: read        # checkout
  packages: write       # push to GHCR
  id-token: write       # OIDC to a cloud provider
  pull-requests: write  # comment on or label a PR
  checks: write         # publish check runs

How to prevent it

• Bind workloadIdentityUser to the exact repo principalSet.
• Keep the provider attribute condition aligned with assertion.repository.
• Use the full provider resource path in the auth step.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions