Assign GCP functions service account roles to engage with Firebase using Terraform

Question

I want to use the Firebase Admin SDK in my GCP cloud function, specifically for creating custom auth tokens.

I was getting auth/insufficient-permission errors after deployment and got to this thread. Note that it talks about Firebase functions, while I use pure GCP Cloud Functions.

To my understanding, GCP Cloud Functions uses the default App Engine service account, which is missing the Firebase Admin SDK admin service agent role.

I manually added it through the GCP console and it seems to solve the issue, but now I want to automate it via terraform where I manage my infrastructure.

1. How do I access the default App Engine service account? I think it's auto created when the GCP project is created.
2. How do I add the relevant role to it without changing other service accounts using that roles?
3. Is this it right approach, or is there a better way I'm missing?

The relevant documentation I was looking at is here. Note that I'm using initializeApp() without arguments, i.e. letting the library to discover the service account implicitly.

Answer 1

1. How to get the default App Engine service account through Terraform: google_app_engine_default_service_account

2. How to work with 'additional' IAM roles assigned to a service account: IAM policy for service account

3. For general recommendations - I would prefer to use a specifically created service account and completely delete (or disable) the default App Engine service account.

Edit ==> Additional details as requested

Here is a description of Cloud Function service account in runtime:

The App Engine service account has the Editor role, which allows it broad access to many Google Cloud services. While this is the fastest way to develop functions, Google recommends using this default service account for testing and development only. For production, you should grant the service account only the minimum set of permissions required to achieve its goal.

Thus, it may be useful to delete/disable App Engine service account, create a specific service account for the given cloud function, assign it all relevant minimum of IAM roles, and use it.

As a side note I also would suggest to delete/disable the default Compute Engine service account, delete the default network with all firewall rules and subnetworks... But this is a separate story.