0

We have set up the Remote Config for our app at Google Firebase, which is accessed via a Service Account that is meant to have a Role with minimal requirements. Would be perfect to have permissions for read-only access to the Remote Config only.

However we cannot come up with the working set. Firebase Viewer role works fine, but there are 107 permissions attached to it. Obviously we don't need that many? For example I successfully removed all prefixed with automl. (20+ or something) But as soon as I go deeper for seemingly unrelated ones, like: firebasedynamiclinks.domains.list or logging.logEntries.list or cloudtestservice.environmentcatalog.get it blows up and remoteConfig endpoint for the project starts to return http error 500 (internal error). Which in my interpretation signals about some conflict in the remaining set of permissions.

Are there some determined permissions for reading Remote Config only?

jayarjo
  • 16,124
  • 24
  • 94
  • 138

1 Answers1

6

Firebase IAM Permissions lists the roles required for each product.

The only Remote Config permissions are cloudconfig.configs.get and cloudconfig.configs.update

Since you'd like your service account to have read-only access, the only permissions you should need are cloudconfig.configs.get and the permissions required for all roles (i.e., firebaseanalytics.resources.googleAnalyticsReadAndAnalyze, resourcemanager.*, servicemanagement.* and serviceusage.*).

Lucas P
  • 125
  • 5
  • I tried that, but it kept throwing `internal error`. That's why I created this question in first place :/ – jayarjo Mar 23 '19 at 04:54
  • 1
    @jayarjo: I've a service account with `cloudconfig.configs.get` and `firebaseanalytics.resources.googleAnalyticsReadAndAnalyze` (one of the permissions listed in [Permissions required for all roles](https://firebase.google.com/docs/projects/iam/permissions#required_all_roles)) on the Firebase docs site. Using that Service Account, I was able to successfully `get` from the Remote Config endpoint. :| (Verified that both were required, because when I removed either of those permissions, my `get` calls started failing) – Lucas P Mar 24 '19 at 23:42