It takes 24h+ before you'll see the 403s turn into 200s. This is because Google only adds your service account to the bucket read permissions at the next report generation moment.