2

I have a firebase project with a google cloud function like this:

export const myFun = functions.region("europe-west1")
    .runWith({ timeoutSeconds: 10, secrets: ['MY_SECRET'] })
    .https.onCall((data, context) => {/*doStuff()*/});

The function uses MY_SECRET to access a db. Everything works perfectly fine when I build and deploy this function from my local machine to google cloud. I can access it and i get the results from the db, all good.

However, I setup a github action to deploy this function to the cloud for me. For this i setup a service account as a github secret so I can run npx firebase-tools deploy inside the github action. This always worked, UNTIL I added the secrets: ['MY_SECRET'] to the cloud function.

Locally I can still sucessfully deploy, but the github action fails:

Error: Failed to validate secret versions:
- FirebaseError HTTP Error: 403, Permission 'secretmanager.versions.get' denied for resource 'projects/my-project/secrets/MY_SECRET/versions/latest' (or it may not exist).

I made sure the secret actually exists in the correct google cloud project, and the service account I use in github DOES have the role Secret Manager Secret Accessor , but I still get the error.

One thing I noticed though is that when I go to the secret manager in the browser and click on my secret, I see:

Resource ID projects/123456789/secrets/MY_SECRET

and the error says projects/my-project/secrets/MY_SECRET/versions/latest

So in the build step, the project name is used, and in the secret manager i see the project id. Not sure if this is relevant, just something i noticed...

Why does this not work? I tried for hours and am getting desperate, pls help 😅

2 Answers 2

9

...Ok, found the solution after wasting wayyy to much time...

Turns out the Secret Manager Secret Accessor role is not enough, the Secret Manager Viewer role is also needed! 🤦‍♂️🤦‍♂️🤦‍♂️

2
  • 3
    It seems to me that the runtime service account needs 'Secret Manager Secret Accessor' to access the secret and the deploying account needs 'Secret Manager Viewer' to view the secret metadata.
    – abegehr
    Aug 7, 2022 at 10:48
  • This was my issue as well, but somewhat different. I am deploying my functions using a GitHub action, but I had added these roles to my app default service account. When I added the roles to the github service account, it passed and started working.
    – dzylich
    Dec 18, 2022 at 17:21
0

Secret Accessor is the correct role, it needs to be given to the functions Runtime Service Account. See this answer: Can't access secret stored in Secrets Manager from Google Cloud Function

Runtime service accounts: https://cloud.google.com/functions/docs/concepts/iam#runtime_service_accounts

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.