I would like to allow users to impersonate a service account to do operations on a long running process. 
However, all the code examples illustrate a service account impersonating another service account.

Can users directly impersonate a service account? If so, how?

I'm following [this example code](https://google-auth.readthedocs.io/en/latest/reference/google.auth.impersonated_credentials.html).

**Initialize a source credential which does not have access to list bucket:**

```
from google.oauth2 import service_acccount

target_scopes = [
    'https://www.googleapis.com/auth/devstorage.read_only']

source_credentials = (
    service_account.Credentials.from_service_account_file(
        '/path/to/svc_account.json',
        scopes=target_scopes))

```

**Now use the source credentials to acquire credentials to impersonate another service account:**

```
from google.auth import impersonated_credentials

target_credentials = impersonated_credentials.Credentials(
  source_credentials=source_credentials,
  target_principal='impersonated-account@_project_.iam.gserviceaccount.com',
  target_scopes = target_scopes,
  lifetime=500)

```