To use this functionality, first create the service account you want to
impersonate. Then grant users that you want to be able to impersonate
this service account the
roles/iam.serviceAccountTokenCreator role on
the service account resource. Then, you also need to grant the service
account the same role on itself. This allows it to create short-lived
tokens identifying itself, and allows your human users (or other service
accounts) to do the same. More information on this scenario is available
Once you've granted the appropriate permissions, you'll need to enable
the IAM Service Account Credentials API.
Enabling the API and granting the role are eventually consistent operations,
taking up to 7 minutes to fully complete, but usually fully propagating within 60
seconds. Give it a few minutes, then add the
option to your BigQuery profile configuration.