firebase / firebase/firebase-tools
Firebase CLI ignores GOOGLE_APPLICATION_CREDENTIALS and uses missing default service account
- Dominant language
- TypeScript
- Stars
- 4.5k
- Forks
- 1.3k
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 84
Description
### [REQUIRED] Environment info
**firebase-tools:** 14.2.1
**Platform:** macOS
### [REQUIRED] Test case
Running the following commands fails to deploy the extension and ignores the provided custom service account:
```bash
GOOGLE_APPLICATION_CREDENTIALS="./serviceAccount.prod.json" firebase deploy --only extensions --project=
```
or
```bash
firebase deploy --only extensions --project=
```
Need to run without service account created (delete)
### [REQUIRED] Steps to reproduce
1. Remove the default service account
2. Create a custom service account with all necessary permissions.
3. Set `GOOGLE_APPLICATION_CREDENTIALS` to its credentials JSON.
4. Deploy an extension using `firebase deploy --only extensions`.
5. Notice that Firebase ignores the custom account and tries to use the default compute account.
### [REQUIRED] Expected behavior
Firebase CLI should fully respect the `GOOGLE_APPLICATION_CREDENTIALS` variable and use the provided credentials for all operations (IAM, Cloud Functions, etc.).
### [REQUIRED] Actual behavior
The CLI ignores the custom credentials and attempts to use a non-existent default compute account, resulting in the following error:
```
Error: Request to https://cloudresourcemanager.googleapis.com/v1/projects/:setIamPolicy had HTTP Error: 400, Service account -compute@developer.gserviceaccount.com does not exist.
```
Additional console errors:
```json
"ResourceErrorCode":"500",
"ResourceErrorMessage":"Gen1 operation for function ... failed."
...
"code":"404",
"message":"Service account projects/-/serviceAccounts/-compute@developer.gserviceaccount.com was not found."
```
This default service account does **not exist** in my project and **should not be used**.
Contributor guide
Assessment
This issue has not been assessed yet.