Error 403 when create temporaryUrl in cloud run

[tsulatsitamim]

Client error: `POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[PROJECTNUMBER][email protected]:signBlob?alt=json` resulted in a `403 Forbidden` response.

"code": 403
"message": "Request had insufficient authentication scopes.",
"status": "PERMISS (truncated...)"

It's work fine in local development when using json key_file, but when deployed to cloud run with key_file set to empy string I get 403 error when creating temporaryUrl, it works fine to upload or set file visibilty to public, did I do something wrong?

[the-provost]

Any solutions? or workarounds?

[tsulatsitamim]

simple workaround by manually provide service account or ship service account json file with the container