The current IAM role for Subscriber only gives the following permissions:

• pubsub.subscriptions.consume
• pubsub.topics.attachSubscription

This library uses pubsub.subscriptions.get when constructing the subscriber. This causes a permission denied exception to be thrown.

It is not documented anywhere that the Java client library requires this permission. My assumption as a user is that the IAM role for subscriber gives me all the required permissions to subscribe. For Java Publisher, the publisher role has all the needed permissions using the IAM publisher role. For Python Subscriber, Subscriber IAM role has sufficient permissions.