How to give the correct permissions to a GCP service account to update Firestore and Storage rules?

user_9504329 0
Viewed 537

I have an automated process to update a Firebase project's Firestore and storage rules. It always throughs permission denied errors. I've tried a combination of the predefined IAM roles such as Firebase Rules Admin, Firebase Rules System, and Firebase Rules Viewer. and even a combination of all three failed.

When giving the service account the Firebase Admin IAM role, it worked; however, I'd like to avoid giving this service account excess permissions due to best security practices following the principle of least privilege.

I found this documentation for specific permissions needed: https://firebase.google.com/docs/projects/iam/permissions#security-rules but after creating a new IAM role with all 13 of the permissions, it was still denied.

What is the correct set of least permissions needed to only allow the service account to update rules and rules only? (Firestore and storage)

firebase-security service-accounts google-cloud-firestore firebase google-cloud-platform
1 Answers

I don't know the answer but here's how I'd work it out.

Firebase Admin is defined under Firebase-level roles:

https://firebase.google.com/docs/projects/iam/roles-predefined-all-products

NOTE Apologies, was unable to grab a link to the specific role on mobile

This shows all the permissions.

You should be able to determine which permissions are missing by checking the permissions of the other roles that you tried.

It would be helpful if you include the command and the specific errors that you received. Usually (!) these help scope the permission(s) that are missing.

user_6092900
Related