...
In the GCP Console, open the IAM & Admin page.
In the left bar click IAM.
Edit roles for service-<some_number>@gcp-sa-datafusion.iam.gserviceaccount.com.
In the Edit permissions page, add the role Cloud Datastore Owner and click on Save.
5. Perform similar steps (i.e. add the same roles) for the compute engine default service account to allow the pipeline to access Datastore during its execution on Dataproc.
...