Permission denied to google cloud secret on firebase function deploy

Question

I have a firebase project with a google cloud function like this:

export const myFun = functions.region("europe-west1")
    .runWith({ timeoutSeconds: 10, secrets: ['MY_SECRET'] })
    .https.onCall((data, context) => {/*doStuff()*/});

The function uses MY_SECRET to access a db. Everything works perfectly fine when I build and deploy this function from my local machine to google cloud. I can access it and i get the results from the db, all good.

However, I setup a github action to deploy this function to the cloud for me. For this i setup a service account as a github secret so I can run npx firebase-tools deploy inside the github action. This always worked, UNTIL I added the secrets: ['MY_SECRET'] to the cloud function.

Locally I can still sucessfully deploy, but the github action fails:

Error: Failed to validate secret versions:
- FirebaseError HTTP Error: 403, Permission 'secretmanager.versions.get' denied for resource 'projects/my-project/secrets/MY_SECRET/versions/latest' (or it may not exist).

I made sure the secret actually exists in the correct google cloud project, and the service account I use in github DOES have the role Secret Manager Secret Accessor , but I still get the error.

One thing I noticed though is that when I go to the secret manager in the browser and click on my secret, I see:

Resource ID projects/123456789/secrets/MY_SECRET

and the error says projects/my-project/secrets/MY_SECRET/versions/latest

So in the build step, the project name is used, and in the secret manager i see the project id. Not sure if this is relevant, just something i noticed...

Why does this not work? I tried for hours and am getting desperate, pls help 😅

Austroasiatic

Answer 1

...Ok, found the solution after wasting wayyy to much time...

Turns out the Secret Manager Secret Accessor role is not enough, the Secret Manager Viewer role is also needed! 🤦‍♂️🤦‍♂️🤦‍♂️

Austroasiatic

It seems to me that the runtime service account needs 'Secret Manager Secret Accessor' to access the secret and the deploying account needs 'Secret Manager Viewer' to view the secret metadata. – Sihunn

This was my issue as well, but somewhat different. I am deploying my functions using a GitHub action, but I had added these roles to my app default service account. When I added the roles to the github service account, it passed and started working. – Jabe

This is the only thing that works. NOTE: If you are running into this problem when using Google Cloud build pipeline, then you need to give both the "Secret Manager Accessor" and "Secret Manager Viewer" roles to the [hash]@gcloudbuild.gserviceaccount.com (the default 'Cloud Build Service Account', or whatever service account you use for the GC build trigger) – Pitre

Answer 2

If you're using 2nd gen Firebase Functions, Firebase now uses a different IAM account, so you may need to update your permissions.

https://cloud.google.com/functions/docs/concepts/iam#runtime_service_accounts

At runtime, Cloud Functions (1st gen) defaults to using the App Engine default service account ([email protected]), which has the Editor role on the project. Cloud Functions (2nd gen) defaults to using the Compute Engine default service account ([email protected]), which also has the Editor role on the project.

Overcast

This is the key, if fusing 2nd gen Firebase functions you need to give the role to the [email protected] account – Freida

Answer 3

Secret Accessor is the correct role, it needs to be given to the functions Runtime Service Account. See this answer: Can't access secret stored in Secrets Manager from Google Cloud Function

Runtime service accounts: https://cloud.google.com/functions/docs/concepts/iam#runtime_service_accounts

Bushel