title: GCP - Impersonate service account as a user
body: <p>I would like to allow users to impersonate a service account to do operations on a long running process. 
  However, all the code examples illustrate a service account impersonating another service account.</p>
  
  <p>Can users directly impersonate a service account? If so, how?</p>
  
  <p>I'm following <a href="https://google-auth.readthedocs.io/en/latest/reference/google.auth.impersonated_credentials.html" rel="noreferrer">this example code</a>.</p>
  
  <p><strong>Initialize a source credential which does not have access to list bucket:</strong></p>
  
  <pre><code>from google.oauth2 import service_acccount
  
  target_scopes = [
      'https://www.googleapis.com/auth/devstorage.read_only']
  
  source_credentials = (
      service_account.Credentials.from_service_account_file(
          '/path/to/svc_account.json',
          scopes=target_scopes))
  </code></pre>
  
  <p><strong>Now use the source credentials to acquire credentials to impersonate another service account:</strong></p>
  
  <pre><code>from google.auth import impersonated_credentials
  
  target_credentials = impersonated_credentials.Credentials(
    source_credentials=source_credentials,
    target_principal='impersonated-account@_project_.iam.gserviceaccount.com',
    target_scopes = target_scopes,
    lifetime=500)
  </code></pre>