How to use service account to authenticate Cloud Run to Firestore

Question

I'm looking for a way to connect Cloud Run to Firestore without using a service account access key. I have a key set up for my local dev environment to access Firestore. I know you can access Firestore from the account running Cloud Run containers, but haven't been able to find any documentation on how to do this.

The most I could find is using a Workforce Identity Federation but that seems to be focused on connecting external services which isn't my goal.

Edit, forgot to mention I'm using nodejs and am not using firebase, just firestore

Answer 1

Every service in Cloud Run has a service account assigned (default Compute Engine service account), but you can create you own service account and assign it (Recommended), you don't need to download a key.

Cloud Run console

In the IAM section look for datastore permissions instead of Firestore permissions, because Firestore is the 'evolution' of datastore.

Follows the doc for more info: https://cloud.google.com/run/docs/configuring/service-accounts