Cannot impersonate GCP ServiceAccount even after granting “Service Account Token Creator” role

Question

I have 2 ServiceAccounts in my Google Cloud Platform (GCP) Project

• owner
• executor

The owner ServiceAccount has 1 project-wide role attach