title: Dataflow setting Controller Service Account
body: <p>I try to set up controller service account for Dataflow. In my dataflow options I have:</p>
  <pre><code>options.setGcpCredential(GoogleCredentials.fromStream(
                           new FileInputStream(&quot;key.json&quot;)).createScoped(someArrays)); 
  options.setServiceAccount(&quot;xxx@yyy.iam.gserviceaccount.com&quot;);
  </code></pre>
  <p>But I'm getting:</p>
  <pre><code>WARNING: Request failed with code 403, performed 0 retries due to IOExceptions,         
           performed 0 retries due to unsuccessful status codes, HTTP framework says 
           request can be retried, (caller responsible for retrying): 
           https://dataflow.googleapis.com/v1b3/projects/MYPROJECT/locations/MYLOCATION/jobs
  Exception in thread &quot;main&quot; java.lang.RuntimeException: Failed to create a workflow 
           job: (CODE): Current user cannot act as 
           service account &quot;xxx@yyy.iam.gserviceaccount.com. 
           Causes: (CODE): Current user cannot act as 
           service account &quot;xxx@yyy.iam.gserviceaccount.com.
      at org.apache.beam.runners.dataflow.DataflowRunner.run(DataflowRunner.java:791)
      at org.apache.beam.runners.dataflow.DataflowRunner.run(DataflowRunner.java:173)
      at org.apache.beam.sdk.Pipeline.run(Pipeline.java:311)
      at org.apache.beam.sdk.Pipeline.run(Pipeline.java:297)
  </code></pre>
  <p>...</p>
  <pre><code>Caused by: com.google.api.client.googleapis.json.GoogleJsonResponseException: 403 Forbidden
  {
    &quot;code&quot; : 403,
    &quot;errors&quot; : [ {
      &quot;domain&quot; : &quot;global&quot;,
      &quot;message&quot; : &quot;(CODE): Current user cannot act as service account 
                   xxx@yyy.iam.gserviceaccount.com. Causes: (CODE): Current user
                   cannot act as service account xxx@yyy.iam.gserviceaccount.com.&quot;,
      &quot;reason&quot; : &quot;forbidden&quot;
    } ],
    &quot;message&quot; : &quot;(CODE): Current user cannot act as service account 
                 xxx@yyy.iam.gserviceaccount.com. Causes: (CODE): Current user 
                 cannot act as service account xxx@yyy.iam.gserviceaccount.com.&quot;,
    &quot;status&quot; : &quot;PERMISSION_DENIED&quot;
  }
  </code></pre>
  <p>Am I missing some Roles or permissions?</p>