1

We have an API app that uses Firebase Admin to send messages to devices. Earlier, we used to specify the service account key using environment variable like GOOGLE_APPLICATION_CREDENTIALS="path_to_file.json". But now, since we are shifting to AWS Elastic Container Service on Fargate, I am unable to figure out how to put this file in the container for AWS ECS.

Any advice highly appreciated.

Thanks

Samyak Jain
  • 41
  • 1
  • 6

4 Answers4

3

Solved it by storing the service key as a JSON Stringified environment variable & using admin.credential.cert() instead of defaultAppCredentials. Refer: https://firebase.google.com/docs/reference/admin/node/admin.credential#cert

Samyak Jain
  • 41
  • 1
  • 6
1

I would suggest instead AWS Secrets Manager that is purpose-built for storing secrets. Take a look to his blog post:

https://aws.amazon.com/blogs/compute/securing-credentials-using-aws-secrets-manager-with-aws-fargate/

herbertgoto
  • 339
  • 1
  • 5
  • 3
    Are you suggesting to put the entire json as a secret value? We are already using AWS Secrets Manager for other environment variables, but as suggested on https://cloud.google.com/docs/authentication/getting-started#setting_the_environment_variable, the GOOGLE_APPLICATION_CREDENTIALS needs to be a file path. How should I put a new file after the image is already built? – Samyak Jain Oct 13 '20 at 10:04
  • As long as you keep it within Secrets Manager Quotas, there will not be a problem to do that. (https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_limits.html) – herbertgoto Oct 13 '20 at 16:19
  • Solved it by storing the service key as an environment variable & using admin.credential.cert() instead of defaultAppCredentials. Refer: https://firebase.google.com/docs/reference/admin/node/admin.credential#cert – Samyak Jain Oct 14 '20 at 10:05
0

Even better than using environment variables which have their own downsides, you can leverage AWS Parameter Store which is a secure way to manage secrets in the AWS environment (where secrets are encrypted both in transit and at rest).

You'd need to create an IAM role for Amazon ECS for your code to have access to the Parameter Store.

You may want to check this article: https://aws.amazon.com/blogs/compute/managing-secrets-for-amazon-ecs-applications-using-parameter-store-and-iam-roles-for-tasks/

Max Ivanov
  • 5,695
  • 38
  • 52
0

Use the specific method from_service_account_info as described here. You then pass the content of the credentials json file as a dictionary.

Jordi Prat Camps
  • 1