An on-prem app using a user-managed service account key over Dedicated Interconnect and Private Google Access gets 403 Permission Denied accessing Cloud Storage objects. What's the likely cause?

A 403 Permission Denied error, especially when using a service account key, strongly suggests an authentication or authorization issue. If a service account key is rotated, the old key becomes invalid. If the application server is still using the old, invalid key, it will fail to authenticate, resulting in a 403 error. The folder structure or object paths changing would likely result in a 404 Not Found error, not a 403 Permission Denied. Changes to the service account's predefined role permissions could cause a 403, but key rotation is a more direct and common cause for a complete denial of access when a key is explicitly used. A temporary outage of the Interconnect link would typically manifest as connection timeouts or network errors, not a 403 Permission Denied, which indicates the request reached Google Cloud but was rejected due to insufficient permissions or invalid credentials.