The "Service Account Token Creator" IAM roles need to be granted to the service account ext-justpass-me@{project-name}.iam.gserviceaccount.com running the extension
- Open the IAM and admin page in the Google Cloud Console.
- Select your project and click "Continue".
- Click the edit icon corresponding to the service account you wish to update.
- Click on "Add Another Role".
- Type "Service Account Token Creator" into the search filter, and select it from the results.
- Click "Save" to confirm the role grant.
As a best practice, you can monitor the activity of your installed extension, including checks on its health, usage, and logs.