I am deploying the signal app server. Deployed the code in ec2 instance and its running as well. but when i ma hitting the API : /v1/verification/session
getting below error.

Failed to retrieve identity token

! com.google.api.client.http.HttpResponseException: 403 Forbidden
! POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[email protected]:generateAccessToken
! {
!   "error": {
!     "code": 403,
!     "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist).",
!     "errors": [
!       {
!         "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist).",
!         "domain": "global",
!         "reason": "forbidden"
!       }
!     ],
!     "status": "PERMISSION_DENIED",
!     "details": [
!       {
!         "@type": "type.googleapis.com/google.rpc.ErrorInfo",
!         "reason": "IAM_PERMISSION_DENIED",
!         "domain": "iam.googleapis.com",
!         "metadata": {
!           "permission": "iam.serviceAccounts.getAccessToken"
!         }
!       }
!     ]
!   }
! }
! 

! at com.google.api.client.http.HttpResponseException$Builder.build(HttpResponseException.java:293)
! at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1118)
! at com.google.auth.oauth2.ImpersonatedCredentials.refreshAccessToken(ImpersonatedCredentials.java:524)
! ... 62 common frames omitted
! Causing: java.io.IOException: Error requesting access token
! at com.google.auth.oauth2.ImpersonatedCredentials.refreshAccessToken(ImpersonatedCredentials.java:526)
! at com.google.auth.oauth2.ExternalAccountCredentials.exchangeExternalCredentialForAccessToken(ExternalAccountCredentials.java:464)
! at com.google.auth.oauth2.AwsCredentials.refreshAccessToken(AwsCredentials.java:151)
! at com.google.auth.oauth2.OAuth2Credentials$1.call(OAuth2Credentials.java:257)
! at com.google.auth.oauth2.OAuth2Credentials$1.call(OAuth2Credentials.java:254)
! at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
! at com.google.common.util.concurrent.DirectExecutor.execute(DirectExecutor.java:31)
! at com.google.auth.oauth2.OAuth2Credentials$AsyncRefreshResult.executeIfNew(OAuth2Credentials.java:580)

The service account have the permission. but i am not able to figure out why the permission issue is coming. When i am hitting the below curl using gcloud its giving me the token.

curl -X POST 
  -H "Authorization: Bearer $(gcloud auth print-access-token)" 
  -H "Content-Type: application/json" 
  -d '{
    "delegates": [],
    "scope": ["https://www.googleapis.com/auth/cloud-platform"],
    "lifetime": "3600s"
  }' 
  "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[email protected]:generateAccessToken".

any one who successfully deployed and run the signal server.Any help really appreciated.