Unable to assign iam.serviceAccounts.signBlob permission

TLDR; I'm having trouble assigning an IAM permission to a service account.

I'm building a test that involves minting custom tokens with firebase Auth. When I hit:

  const token = await admin.auth().createCustomToken('test', {
    isAdmin: true,
  })

the following error is thrown

Permission iam.serviceAccounts.signBlob is required to perform
this operation on service account 
projects/-/serviceAccounts/dashboard@appspot.gserviceaccount.com.;
Please refer to 
https://firebase.google.com/docs/auth/admin/create-custom-tokens
for more details on how to use and troubleshoot this feature

In the referenced documentation it says to add the Service Account Token Creator role to the service account. I have added that role (as well as tried Service Account Admin to no avail.

I can verify that my permissions seem to be correctly set, when I run gcloud projects get-iam-policy project I can see my service account attached to the desired role

- members:
  - serviceAccount:dashboard@appspot.gserviceaccount.com
  role: roles/iam.serviceAccountTokenCreator

However if I look at that specific service account, it seems to show up empty which would fall in line with my error:

gcloud iam service-accounts get-iam-policy dashboard@appspot.gserviceaccount.com
etag: ACAB

• Why would those two commands & cloud console show differing information?

I assume that whatever is causing my service account permissions to show up blank is the culprit, but I'm not sure where to debug further. It seems to me the only difference is one command is called with a project in it, but I initialize my firebase app with the project id, and have verified it with (firebase-admin).apps[0].options so it seems like a dead end.

The sign feature of a service account requires the iam.serviceAccounts.signBlob permission. This permission is included in the Service Account Token role roles/iam.serviceAccountTokenCreator

You can assign this role at the "project" level or at the "service account" level. This is why you see different results. Assigning roles at the project level affects permissions for all service accounts. Assigning roles at the service account only affects that service account.

The key to your problem is that the caller does not have this role on service account dashboard@appspot.gserviceaccount.com. You have given the service account permission and NOT the caller. Look into your code for the service account that you used to setup the Firebase SDK.

Another option is to grant the role to {YOUR_PROJECT_NAME}@appspot.gserviceaccount.com (1st gen) or {RANDOM_NUMBER}-compute@developer.gserviceaccount.com (2nd gen) but that grants permission to use any service account.

A service account is both an identity and a resource. You need permission for the resource. That permission can be granted via a service account's IAM policy or via the project's IAM policy.