firestore 备份 function 错误，“PERMISSION_DENIED：调用者没有权限”

Question

I'm trying to set up a scheduled firebase function that will export all collections in Firestore every 24 hours. I'm using this script for that:

import {fs} from '../services/firestore';

import * as functions from 'firebase-functions';
import * as firestore from '@google-cloud/firestore';

const client = new firestore.v1.FirestoreAdminClient();

const bucket = 'gs://my-cool-backup';

export const scheduledFirestoreExport = functions
    .region('europe-west1')
    .pubsub
    .schedule('every 24 hours')
    .onRun(async (context) => {
        const collections = await fs.listCollections();

        const projectId = process.env.GCP_PROJECT || process.env.GCLOUD_PROJECT;
        const databaseName =
            client.databasePath(projectId, '(default)');

        const responses = await client.exportDocuments({
            name: databaseName,
            outputUriPrefix: bucket,
            collectionIds: collections.map(x => x.id)
        });

        const response = responses[0];
        console.log(`Operation Name: ${response['name']}`);
        return response;
    });

../services/firestore looks like this:

import * as settings from '../settings.json';
import * as serviceAccount from '../firebase-admin.json';
import * as admin from 'firebase-admin';

export const fs = admin.initializeApp({
    credential: admin.credential.cert(serviceAccount as any),
    ...settings.firebase
}).firestore();

When I trigger the function using the Google Cloud Platform, this is the output:

Error: function execution failed. Details:
7 PERMISSION_DENIED: The caller does not have permission

The service account I'm using has the following permissions

I have many functions running without any problems, just this one is failing. I suspect it's because of @google-cloud/firestore , whereas the other ones only use firebase-admin

The error message gives me very little to go with. What am I missing here?

Answer 1

This is most certainly an issue with permission on the service account you are using.

You can follow this link for settings Role (roles/datastore.user) [1], [2] for firestore on service account

[1] https://cloud.google.com/firestore/docs/quickstart-servers#set_up_authentication

[2] https://cloud.google.com/firestore/docs/security/iam#roles