so what every i am doing in the gcp giving it roles iam roles to configure the policies , i am not able to do to my firebase project. i am able to log into it using my terminal with firebase login and then then firebare init is there and i put the function initilaize but it says i don't have permission to do that i need to give it permission so i open the file
/iam-admin/iam?folder=&organizationId=&project=clone-6de06 because this is my firebase project but i dont' have access to it in the gcp so i am not able to change the permission to change the policy or
need to run the role command
gcloud projects add-iam-policy-binding ourcafe-mucqxq
--member=serviceAccount:service-1044193269753#gcf-admin-robot.iam.gserviceaccount.com
--role=roles/cloudfunctions.serviceAgent as that says it will take care of following error: Deployment of your Cloud Function failed:
Missing necessary permission resourcemanager.projects.getIamPolicy for
service-1044193269753#gcf-admin-robot.iam.gserviceaccount.com on
resource projects/ourcafe-mucqxq. Please grant
service-1044193269753#gcf-admin-robot.iam.gserviceaccount.com the
Cloud Functions Service Agent
any help will be appreciated thank for the help.
Did you try to log in to firebase with a proper account?
If you're not sure that your account with proper permission, you can go to Firebase project >> Project settings >> Users and permission to check that your account is on the list with the right permission.
Also, you can see all of the accounts on the IAM of GCP console.
Related
I am switching my Firebase functions from one Firebase account to another.
I have rerun firebase init.
I have added the new service account configs to the project and am passing it to admin.initializeApp. I have logged into GCP via my CLI and have run firebase login:ci as well.
Despite all this, whenever I try to run firebase deploy, I am met with the error:
Missing permissions required for functions deploy. You must have permission iam.serviceAccounts.ActAs on service account #appspot.gserviceaccount.com.
Any idea what's going on here?
This doesn't have anything to do with the service account you use to initialize the Firebase Admin SDK. The error has to do with the lack of permission of the Google Account that you used to sign in with the Firebase CLI. It doesn't have permission to deploy to Cloud Functions. You should either sign out then sign back in with an account that has permission (typically "editor" role), or add the appropriate permission to the account that you want to use.
If you're migrating to a new Firebase project / account, you must delete the project's existing .firebaserc and firebase.json files before running firebase init - this will ensure that you're using the updated project configs.
Permissions recommended for the Cloud Build service account in the official Google documentation and the Firebase CLI community builder docs are insufficient:
In the permissions table, locate the email ending with #cloudbuild.gserviceaccount.com, and click on the pencil icon.
Add Cloud Build Service Account, Firebase Admin and API Keys Admin roles.
I still get the following error in Cloud Build when I do firebase deploy:
Error: HTTP Error: 403, The caller does not have permission
What I've tried is different Firebase IAM roles, Editor, and Owner. So far only the Owner role works. That is way too much privilege for a Cloud Build service account, and violates the least-privilege model.
Everything is in the same Google Cloud project.
Anyone know how to troubleshoot this? Or know which role/permission is missing?
For our project (which uses Firestore, Functions, Hosting, and Storage extensively) here is the list we came up with. Critically I wanted to avoid "Firebase Admin" because I did not want this service account to have access to read/write my Firestore data:
Artifact Registry Administrator
Cloud Build Service Account
Cloud Datastore Index Admin
Cloud Functions Admin
Cloud RuntimeConfig Admin
Cloud Scheduler Admin
Firebase Hosting Admin
Firebase Rules Admin
Pub/Sub Admin
Service Account User
tl;dr seems like it was "an accidental permission expansion" that has been corrected.
I am able restrict the roles to:
Cloud Build Service Account
Firebase Admin
API Keys Admin
I was trying to deploy my first firebase cloud function using firebase cli but I encountered an error instead :
C:\Users\Anurag Tripathi\Desktop\firebasecloudfunction> firebase deploy --only functions
Error: Missing permissions required for functions deploy. You must have permission iam.serviceAccounts.ActAs on service account project_number#appspot.gserviceaccount.com.
To address this error, ask a project Owner to assign your account the "Service Account User" role from this URL:
https://console.cloud.google.com/iam-admin/iam?project=project_number
I tried to solve the problem by following the instruction but didn't get any success . Please help.
Edit : I have abandoned the project :( , so I really can't test the answers. Thanks all for the answers and comments. I will accept the most upvoted answer.
This is what worked for me. First run firebase login:list to find out if the account logged into firebase cli is the same account authorized in your Google Cloud Console. If not, run firebase logout <email> then firebase login, then deploy again.
As specified in the docs, apart from the Service Account User role, you should assign the Cloud Functions Admin role to the Service Account that you are using to deploy the functions
It turned out I had the wrong project name in the .firebaserc file. After changing the name to the correct google cloud project name it worked.
firebase projects:list
If the current Firebase account doesn't have your project, you have to logout first.
firebase logout
firebase login
firebase projects:list
firebase use <project ID>
So for example,
firebase use stripesample1
firebase projects:list
firebase deploy --only functions
I was having same issue, I just did firebase logout and firebase login and issue resolved
I had this issue with a co-worker who inherited the Firebase Admin role from the Organization the project belongs to.
I confirmed he had inherited the role but not all the same permissions as when you assign the role manually from Firebase Console -> Users and Permissions.
So, I could have followed the instructions in the link shown in the error log. But I thought it was safer to just re-assign the Firebase Admin role from firebase console. That solved the issue.
I am using the firebase login:ci token for CI/CD. But there is not enough documentation regarding the token.
Does it have access to all my firebase projects where my account has access or only the current active project?
Where can I see a list of all tokens and their activity?
The solution I am going for is creating a throwaway email and adding that to the project I want to deploy. Is this ok?
When you run firebase login:ci you get prompted to log in with a Firebase account. After picking your account, you get a dialog that shows the permissions you're granting. This contains:
This will allow Firebase CLI to:
View and administer all your Firebase data and settings
So if you click Allow in that dialog, the Firebase CLI will have access to all Firebase projects that the account has access to. The generated token does (as far as I know) have access to the same scope.
I am trying to run instrumented tests using the glcoud CLI as a service account in CircleCi. When I run:
gcloud config set project project-name-12345
gcloud auth activate-service-account firebase-testlab-serviceuser#project-name-12345.iam.gserviceaccount.com --key-file ${HOME}/client-secret.json
gcloud firebase test android run --type instrumentation --app debug-app.apk --test debug-test.apk --device model=Nexus6P,version=27,locale=en,orientation=portrait --environment-variables coverage=true,coverageFile=/sdcard/tmp/code-coverage/connected/coverage.ec --directories-to-pull=/sdcard/tmp --timeout 20m
I get:
ERROR: (gcloud.firebase.test.android.run) Could not copy [debug-app.apk] to [gs://test-lab-xxxxxxxx-yyyyyyyy/2018-01-18_17:14:09.964449_zPAw/] ResponseError 403: firebase-testlab-serviceuser#project-name-12345.iam.gserviceaccount.com does not have storage.objects.create access to bucket test-lab-xxxxxxxx-yyyyyyyy..
Using the API Console (https://console.cloud.google.com/iam-admin/iam/project) I've given my service user all the permission I can think would be relevant:
Firebase Crash Symbol Uploader
Firebase Test Lab Admin
Storage Admin
Storage Object Admin
Storage Object Creator
Storage Object Viewer
Firebase Rules System
Any help would be greatly appreciate. Thanks.
You should be able to use a service account created in the Google Cloud Console. Did your service account have the required project Editor role? (as noted in this doc: https://firebase.google.com/docs/test-lab/continuous)
After lots of clicking through the Firebase console and the Google Cloud Console, reading SO, asking for help on Slack, and more trial and error than I care to admit, I discovered that the Firebase console has a service account page:
https://console.firebase.google.com/u/0/project/project-name-12345/settings/serviceaccounts/adminsdk
That is different from the service accounts page in the Google Cloud Console
https://console.cloud.google.com/iam-admin/serviceaccounts/project?project-name-12345
It turns out you want the Firebase service account, you can not create one via the cloud console. Super, super annoying.
The steps I took to create the key is as follow:
1. Firebase Console https://console.firebase.google.com/
2. Project Settings
3. "Service Accounts" tab
4. Inside "Service Accounts" panel, Firebase Admin SDK
5. At the bottom of "Firebase Admin SDK" panel, "Generate new private key"
This is what Etherton answered
https://stackoverflow.com/a/48327579/2353939
Even after that, I still had some errors. So, I added a bunch of roles as follows.
Firebase Test Lab Admin
Firebase Service Management Service Agent
Firebase Admin SDK Administrator Service Agent
Service Account Token Creator
Storage Object Creator
That also didn't fix. So, finally, I applied P. Davis answer by adding Editor role to the service account.
https://stackoverflow.com/a/48331465/2353939
Steps to add Editor role is as follows
1. Go to google cloud console https://console.cloud.google.com/iam-admin/iam
2. Go into "IAM"
3. Use "client_email" from the json file downloaded from firebase console to find the service account you need to edit
4. Click the "Edit" icon on the right
5. Scroll down and "Add Another Role"
6. Click the input field and type in "Editor" to search
7. Choose the one with subtitle "Edit access to all resource"
8. Save
9. Now you should be able to use it
This is the list of the roles that I put in to my service account :
Firebase - Firebase admin ( I think this is overkill. I might update it later )
Project - Editor
Storage - Storage Object Creator
It does not matter whether you create the service account from Firebase or google cloud console. As long as you have these roles in your service account then you should be able run the Firebase test lab.
For people who stumble upon this and don't want to use the all powerful Project Editor role, here are the roles I'm using for my service account:
Firebase Test Lab Roles
I think the Firebase Analytics Viewer role is not necessary, because it mostly just execute the tests. To view the result we use the developer accounts instead but haven't tried removing it.
We ran into the same permissions issue with storage.objects.create. We have added all the roles that were mentioned here, except for the Editor role which we wanted to avoid, but it still failed. We were using a Service Account and it definitely had the proper permissions.
In the end our workaround was to setup a cloud storage bucket manually and then use it in the --results-bucket argument for gcloud. See the documentation here. That finally fixed it for us.