In my firebase project I have upgraded functions from v1 to v2. Suddenly creating a custom auth token fails with:

FirebaseAuthError: Permission 'iam.serviceAccounts.signBlob' denied on resource (or it may not exist).; Please refer to https://firebase.google.com/docs/auth/admin/create-custom-tokens for more details on how to use and troubleshoot this feature.

I am calling getAuth().createCustomToken(uid).

Do I need to fix permission configuration? Or do I have to use the APIs differently?