Grant only the roles for what the app does
Open IAM & Admin → IAM, tap Grant access, paste the service account's e-mail under New principals, and add only the rows below that Fodide listed for your app. Save.
| Where | Setting | Exact value | Why |
|---|---|---|---|
| IAM → Grant access | Firebase sign-in (Authentication) | Firebase Authentication Adminroles/firebaseauth.admin | Manage the app's users and sign-in settings |
| IAM → Grant access | Firestore database | Cloud Datastore Userroles/datastore.user | Read and write the app's data; nothing else in the project |
| Cloud Storage → the bucket → Permissions (step 5) | Files in ONE bucket | Storage Object Adminroles/storage.objectAdmin | Read, write, delete files in that bucket only; granted on the bucket, not the project |
| IAM → Grant access | Cloud Functions deploy | Cloud Functions Developerroles/cloudfunctions.developer+ Service Account User roles/iam.serviceAccountUser | Upload the app's functions; the second role lets them run as the runtime account |
| IAM → Grant access | Realtime Database | Firebase Realtime Database Adminroles/firebasedatabase.admin | Read and write the realtime database |
| IAM → Grant access | Remote Config | Firebase Remote Config Adminroles/cloudconfig.admin | Change the app's remote settings |
| Google Sheets / Drive / Docs | A sheet or folder of yours | No IAM role. Share the file with the service account's e-mail as Editor or Viewer | The account sees only the files you share |
| Blogger | Posting to your blog | Not possible with a service account | Blogger accepts only a person's own Google sign-in; the app asks you to sign in |
| Google Maps | Maps in the app | An API key (step 8), no role | Maps are called by the app, not by the server |