title: Permission denied on Cloud KMS key when using cloud storage
body: <p>I am using <code>cloud storage</code> upload a file with kms key. Here is my code: </p>
  
  <pre class="lang-js prettyprint-override"><code>await storage.bucket(config.bucket).upload(file, {
    kmsKeyName: `projects/${process.env.PROJECT_ID}/locations/global/keyRings/test/cryptoKeys/nodejs-gcp`,
    destination: 'mmczblsq.kms.encrypted.doc'
  });
  </code></pre>
  
  <p>I have a <code>cloud-storage-admin.json</code> service account with <code>cloud storage admin</code> permission. Initialize the <code>storage</code> with this service account.</p>
  
  <pre class="lang-js prettyprint-override"><code>const storage: Storage = new Storage({
    projectId: process.env.PROJECT_ID,
    keyFilename: path.resolve(__dirname, '../.gcp/cloud-storage-admin.json')
  });
  </code></pre>
  
  <p>And, I use <code>gcloud kms keys add-iam-policy-binding</code> add <code>roles/cloudkms.cryptoKeyEncrypterDecrypter</code> to <code>cloud-storage-admin.json</code> service account.</p>
  
  <p>When I try to upload a file with kms key, still got this permission error: </p>
  
  <blockquote>
    <p>Permission denied on Cloud KMS key. Please ensure that your Cloud Storage service account  has been authorized to use this key.</p>
  </blockquote>
  
  <p><strong>update</strong></p>
  
  <pre class="lang-sh prettyprint-override"><code>☁  nodejs-gcp [master] ⚡  gcloud kms keys get-iam-policy nodejs-gcp --keyring=test --location=global
  bindings:
  - members:
    - serviceAccount:cloud-storage-admin@&lt;PROJECT_ID&gt;.iam.gserviceaccount.com
    - serviceAccount:service-16536262744@gs-project-accounts.iam.gserviceaccount.com
    role: roles/cloudkms.cryptoKeyEncrypterDecrypter
  etag: BwWJ2Pdc5YM=
  version: 1
  </code></pre>