GCP: Unable to decrypt files with SOPS 3.12.1. Asks for `serviceusage.services.use` permissions now

We use `sops` in our company and with `v3.12.1` we now see the following error: ``` Failed to get the data key required to decrypt the SOPS file. Group 0: FAILED projects/REDACTED/locations/europe-west3/keyRings/sops-hsm/cryptoKeys/hb-it: FAILED - | failed to decrypt sops data key with GCP KMS key: rpc error: | code = PermissionDenied desc = Caller does not have required | permission to use project REDACTED. Grant the caller the | roles/serviceusage.serviceUsageConsumer role, or a custom | role with the serviceusage.services.use permission, by | visiting | https://console.developers.google.com/iam-admin/iam/project?project=REDACTED | and then retry. Propagation of the new permission may take a | few minutes. | error details: name = ErrorInfo reason = USER_PROJECT_DENIED | domain = googleapis.com metadata = | map[consoleUrl:https://console.developers.google.com/iam-admin/iam/project?project=REDACTED | consumer:projects/REDACTED containerInfo:REDACTED | service:cloudkms.googleapis.com] | error details: name = Help desc = Google developer console | IAM admin url = | https://console.developers.google.com/iam-admin/iam/project?project=REDACTED | error details: name = LocalizedMessage locale = en-US msg = | Caller does not have required permission to use project | REDACTED. Grant the caller the | roles/serviceusage.serviceUsageConsumer role, or a custom | role with the serviceusage.services.use permission, by | visiting | https://console.developers.google.com/iam-admin/iam/project?project=REDACTED | and then retry. Propagation of the new permission may take a | few minutes. Recovery failed because no master key was able to decrypt the file. In order for SOPS to recover the file, at least one key has to be successful, but none were. ``` Our `.sops.yaml`: ```yaml stores: yaml: indent: 2 creation_rules: - path_regex: hb/it/.* gcp_kms: projects/REDACTED/locations/europe-west3/keyRings/sops-hsm/cryptoKeys/hb-it ``` This is what I run locally for the default credentials: ```shell gcloud auth application-default login --scopes=https://www.googleapis.com/auth/chat.messages,openid,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/chat.messages.create ``` And this returns `null`: ```shell cat ~/.config/gcloud/application_default_credentials.json | jq '.quota_project_id' ``` This was working prior to `v3.12.1` and I fail to understand how the behavior now requires the `serviceUsageConsumer` role. How to reproduce: https://gist.github.com/moritzschmitz-oviva/760ba1eac850e44b004c5502756d5fb4