Ubuntu – Permission denied on Google Cloud Run with Github action

I am successfully able to execute CD(continuous Development) using an owner service account on GitHub Actions & cloud run. But I think better to give minimal access with a new service account. These are the permission/roles that I have assigned.

// Custom Role
    Custom Secret Manager Secret Accessor
       => permissions
          - iam.serviceAccounts.actAs
          - secretmanager.versions.access
// role
Service Account Token Creator

And I am getting

Permission ‘iam.serviceAccounts.getAccessToken’ denied on resource (or
it may not exist).

But iam.serviceAccounts.getAccessToken permission is in the Service Account Token Creator role.

And here is my cloud-run.yml

name: Build and Deploy to Google Cloud run

on: 
    push:
        branches:
            - master

env:
  GAR_LOCATION: ${{ vars.GAR_LOCATION }}
  PROJECT_ID: ${{ vars.PROJECT_ID }}
  REPOSITORY: ${{ vars.REPOSITORY }}
  SERVICE: ${{ vars.SERVICE }}
  GITHUB_SHA: ${{ github.sha }}
  REGION: ${{ vars.REGION }}

jobs:
    deploy:
        permissions:
            contents: 'read'
            id-token: 'write'
        
        runs-on: ubuntu-latest
        steps:
          - name: Checkout Code
            uses: actions/checkout@v3
          - name: Google Auth
            id: auth
            uses: google-github-actions/auth@v0
            with:
              token_format: 'access_token'
              workload_identity_provider: '${{ secrets.WIF_PROVIDER }}'
              service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}'

          - name: Login to GAR
            uses: docker/[email protected]
            with:
              username: 'oauth2accesstoken'
              password: '${{ steps.auth.outputs.access_token }}'
              registry: '${{ env.GAR_LOCATION }}-docker.pkg.dev'

          - name: Build and Push Container
            run: |-
              docker build -t "${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.SERVICE }}:${{ env.GITHUB_SHA }}" ./
              docker push "${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.SERVICE }}:${{ env.GITHUB_SHA }}"

          - name: Deploy to Cloud Run
            id: deploy
            uses: google-github-actions/deploy-cloudrun@v0
            with:
              service: ${{ env.SERVICE }}
              region: ${{ env.REGION }}
              image: ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.SERVICE }}:${{ env.GITHUB_SHA }}
            
          - name: Show Output
            run: echo ${{ steps.deploy.outputs.url }}

It is failing on Google Auth label because of authentication. What will be the minimal permission for a service account to perform the CD?

Thanks in advance.