decision(firestore-send-email): kit/extension parity – kit service account gets project-wide run.invoker #3299

firestore-send-email kit/extension parity. Priority: medium. The kit's runtime identity can invoke any Cloud Run service in the project.

Difference

• Extension:
  • Runtime service account ext-<instance>@ holds only roles/datastore.user, plus roles/eventarc.publisher when events are on.
  • The Eventarc trigger runs as the default compute service account.
• Kit:
  • Each instance's firebase-fn-* service account gets project-level roles/datastore.user, roles/eventarc.eventReceiver, roles/run.invoker and roles/eventarc.publisher. eventarc.publisher is granted even when no channel is configured.
  • The same account is also the trigger's identity.
  • Because run.invoker is project-wide, code running in the mail function, including attachment href fetches, holds credentials that can call every Cloud Run service and 2nd gen function in the project.

Reproduced

The project IAM policy on the test project shows the four roles bound at project level to each kit instance's firebase-fn-* account. ext-sepext@ has only datastore.user and eventarc.publisher.

Code

• Extension: extension.yaml#L42-L46
• Kit: index.ts#L38-L48, #L61-L63

Resolution

Options:

• Grant run.invoker on the function's own service only, not the project. That needs CLI support for resource-scoped roles.
• Use a separate trigger identity, as the extension did.
• Record it as an accepted difference under "Decisions" in firestore-send-email kit tracking issue #3290.

This affects every 2nd gen kit, not just this one.