Firebase Admin SDK Administrator Service Agent role

Question

I have a web application using the firebase auth SDK. I've been working on cutting back access permissions. By default, the associated IAM service account has project editor role, which seems a little dangerous. But it works.

I created a new service account using the IAM admin console. I then created a new role based on the permissions I know the app needs (based off the docs), followed by the usual back-and-forward to minimise the permissions.

However, no matter what permissions are added, modifying users through the SDK with this service account fails. Calling the firebase-auth updateUser or create functions causes an error similar to the following:

FirebaseAuthError: Credential implementation provided to initializeApp() via the "credential" property has insufficient permission to access the requested resource permission

After trying every option under the sun, I came across the (strangely undocumented) role named "Firebase Admin SDK Administrator Service Agent" (one google link suggests the backend id for this role is roles/firebase.sdkAdminServiceAgent). Adding this role make the update and create functions work.

Can anyone explain the purpose of the "Firebase Admin SDK Administrator Service Agent" role? Or is there a way to determine what permissions it adds (so I can add these to my custom IAM role).

willbattel willbattel · Accepted Answer · 2021-03-07T21:36:47

The Firebase Admin SDK Administrator Service Agent role is one of three roles given to new project-default Firebase Admin service accounts as of today, March 7, 2021. The other two roles are Firebase Authentication Admin and Service Account Token Creator.

Though documentation about it is sparse, it seems that the role exists as a consolidated role for providing full access to all Firebase-related products for unrestricted usage in the Firebase Admin SDKs.

Roles granted by Firebase Admin SDK Administrator Service Agent

appengine.applications.get
cloudconfig.configs.get
cloudconfig.configs.update
cloudmessaging.messages.create
datastore.databases.get
datastore.databases.list
datastore.entities.allocateIds
datastore.entities.create
datastore.entities.delete
datastore.entities.get
datastore.entities.list
datastore.entities.update
datastore.indexes.get
datastore.indexes.list
datastore.namespaces.get
datastore.namespaces.list
datastore.statistics.get
datastore.statistics.list
firebase.clients.create
firebase.clients.delete
firebase.clients.get
firebase.clients.list
firebase.clients.update
firebase.projects.get
firebase.projects.update
firebaseauth.configs.create
firebaseauth.configs.get
firebaseauth.configs.update
firebaseauth.users.create
firebaseauth.users.createSession
firebaseauth.users.delete
firebaseauth.users.get
firebaseauth.users.sendEmail
firebaseauth.users.update
firebasedatabase.instances.create
firebasedatabase.instances.get
firebasedatabase.instances.list
firebasedatabase.instances.update
firebasehosting.sites.create
firebasehosting.sites.delete
firebasehosting.sites.get
firebasehosting.sites.list
firebasehosting.sites.update
firebaseml.compressionjobs.create
firebaseml.compressionjobs.delete
firebaseml.compressionjobs.get
firebaseml.compressionjobs.list
firebaseml.compressionjobs.start
firebaseml.compressionjobs.update
firebaseml.models.create
firebaseml.models.delete
firebaseml.models.get
firebaseml.models.list
firebaseml.modelversions.create
firebaseml.modelversions.get
firebaseml.modelversions.list
firebaseml.modelversions.update
firebasenotifications.messages.create
firebasenotifications.messages.delete
firebasenotifications.messages.get
firebasenotifications.messages.list
firebasenotifications.messages.update
firebaserules.releases.get
firebaserules.releases.list
firebaserules.releases.update
firebaserules.rulesets.create
firebaserules.rulesets.delete
firebaserules.rulesets.get
firebaserules.rulesets.list
resourcemanager.projects.get
resourcemanager.projects.list
resourcemanager.projects.update
storage.buckets.create
storage.buckets.delete
storage.buckets.get
storage.buckets.list
storage.buckets.update
storage.objects.create
storage.objects.delete
storage.objects.get
storage.objects.getIamPolicy
storage.objects.list
storage.objects.setIamPolicy
storage.objects.update

Roles granted by Firebase Authentication Admin

firebase.clients.get
firebase.clients.list
firebase.projects.get
firebaseauth.configs.create
firebaseauth.configs.get
firebaseauth.configs.getHashConfig
firebaseauth.configs.update
firebaseauth.users.create
firebaseauth.users.createSession
firebaseauth.users.delete
firebaseauth.users.get
firebaseauth.users.sendEmail
firebaseauth.users.update
resourcemanager.projects.get
resourcemanager.projects.list

Roles granted by Service Account Token Creator

iam.serviceAccounts.get
iam.serviceAccounts.getAccessToken
iam.serviceAccounts.getOpenIdToken
iam.serviceAccounts.implicitDelegation
iam.serviceAccounts.list
iam.serviceAccounts.signBlob
iam.serviceAccounts.signJwt
resourcemanager.projects.get
resourcemanager.projects.list

I was able to determine this in the IAM console within my new GCP project.

Firebase Admin SDK Administrator Service Agent role

2 Answers