I recently came across an issue where the google workspace migration wasn't downloading the Json file. After a lot of struggle, I figured out that google by default blocks service account key creation. To resolve this, follow the below mentioned steps
1) login to https://console.cloud.google.com/iam-admin and select the root org
2) Add Organisation Policy Administrator role
3) Click on Organization policies and then search for "Disable service account key creation" and set the enforcement to OFF.
4) Now you should be able to download the JSON.
