@Test
public void shouldHandlePermissionDenied() throws IOException {

  when(serviceAccountKeyManager.serviceAccountExists(anyString())).thenReturn(true);
  final GoogleJsonResponseException permissionDenied = new GoogleJsonResponseException(
      new HttpResponseException.Builder(403, "Forbidden", new HttpHeaders()),
      new GoogleJsonError().set("status", "PERMISSION_DENIED"));
  doThrow(permissionDenied).when(serviceAccountKeyManager).createJsonKey(any());
  doThrow(permissionDenied).when(serviceAccountKeyManager).createP12Key(any());
  exception.expect(InvalidExecutionException.class);
  exception.expectMessage(String.format(
      "Permission denied when creating keys for service account: %s. Styx needs to be Service Account Key Admin.",
      SERVICE_ACCOUNT));
  sut.ensureServiceAccountKeySecret(WORKFLOW_ID.toString(), SERVICE_ACCOUNT);
}