3

I have a firebase project with a google cloud function like this:

export const myFun = functions.region("europe-west1")
    .runWith({ timeoutSeconds: 10, secrets: ['MY_SECRET'] })
    .https.onCall((data, context) => {/*doStuff()*/});

The function uses MY_SECRET to access a db. Everything works perfectly fine when I build and deploy this function from my local machine to google cloud. I can access it and i get the results from the db, all good.

However, I setup a github action to deploy this function to the cloud for me. For this i setup a service account as a github secret so I can run npx firebase-tools deploy inside the github action. This always worked, UNTIL I added the secrets: ['MY_SECRET'] to the cloud function.

Locally I can still sucessfully deploy, but the github action fails:

Error: Failed to validate secret versions:
- FirebaseError HTTP Error: 403, Permission 'secretmanager.versions.get' denied for resource 'projects/my-project/secrets/MY_SECRET/versions/latest' (or it may not exist).

I made sure the secret actually exists in the correct google cloud project, and the service account I use in github DOES have the role Secret Manager Secret Accessor , but I still get the error.

One thing I noticed though is that when I go to the secret manager in the browser and click on my secret, I see:

Resource ID projects/123456789/secrets/MY_SECRET

and the error says projects/my-project/secrets/MY_SECRET/versions/latest

So in the build step, the project name is used, and in the secret manager i see the project id. Not sure if this is relevant, just something i noticed...

Why does this not work? I tried for hours and am getting desperate, pls help

Patric
  • 1,489
  • 13
  • 28

2 Answers2

12

...Ok, found the solution after wasting wayyy to much time...

Turns out the Secret Manager Secret Accessor role is not enough, the Secret Manager Viewer role is also needed! ‍♂️‍♂️‍♂️

Patric
  • 1,489
  • 13
  • 28
  • 3
    It seems to me that the runtime service account needs 'Secret Manager Secret Accessor' to access the secret and the deploying account needs 'Secret Manager Viewer' to view the secret metadata. – abegehr Aug 07 '22 at 10:48
  • This was my issue as well, but somewhat different. I am deploying my functions using a GitHub action, but I had added these roles to my app default service account. When I added the roles to the github service account, it passed and started working. – dzylich Dec 18 '22 at 17:21
  • This is the only thing that works. NOTE: If you are running into this problem when using Google Cloud build pipeline, then you need to give both the "Secret Manager Accessor" and "Secret Manager Viewer" roles to the [hash]@gcloudbuild.gserviceaccount.com (the default 'Cloud Build Service Account', or whatever service account you use for the GC build trigger) – Edd Apr 06 '23 at 10:28
0

Secret Accessor is the correct role, it needs to be given to the functions Runtime Service Account. See this answer: Can't access secret stored in Secrets Manager from Google Cloud Function

Runtime service accounts: https://cloud.google.com/functions/docs/concepts/iam#runtime_service_accounts

Shawn
  • 71
  • 1
  • 4