I would like a Google Cloud project A (project-a-id) to access the firestore data of another Google Cloud project B (project-b-id). For the same I added project A default service account viz. [email protected] in the IAM of project B and set the role to Cloud Filestore Editor.

In the cloud function of project A, I am trying to access both project A's (its own) firestore as well as project B's firestore but it keeps showing project A default database for both Apps. The code is:

var primaryAppConfig = {
  databaseURL: ''
};
var primaryApp = admin.initializeApp(primaryAppConfig, 'primary');
var primarydb = admin.firestore(primaryApp);

var secondaryAppConfig = {
  databaseURL: ''
};
var secondaryApp = admin.initializeApp(secondaryAppConfig, 'secondary');
var secondarydb = admin.firestore(secondaryApp);

I was under the impression if the default service account of project-a is given rights in project-b it should automatically get rights. At least I found it applicable when I am accessing google cloud storage buckets in this manner.

Is something else to be done? Thanks

I would like a Google Cloud project A (project-a-id) to access the firestore data of another Google Cloud project B (project-b-id). For the same I added project A default service account viz. [email protected] in the IAM of project B and set the role to Cloud Filestore Editor.

In the cloud function of project A, I am trying to access both project A's (its own) firestore as well as project B's firestore but it keeps showing project A default database for both Apps. The code is:

var primaryAppConfig = {
  databaseURL: 'https://project-a-id.firebaseio.'
};
var primaryApp = admin.initializeApp(primaryAppConfig, 'primary');
var primarydb = admin.firestore(primaryApp);

var secondaryAppConfig = {
  databaseURL: 'https://project-b-id.firebaseio.'
};
var secondaryApp = admin.initializeApp(secondaryAppConfig, 'secondary');
var secondarydb = admin.firestore(secondaryApp);

I was under the impression if the default service account of project-a is given rights in project-b it should automatically get rights. At least I found it applicable when I am accessing google cloud storage buckets in this manner.

Is something else to be done? Thanks

• javascript
• google-cloud-firestore
• google-cloud-functions
• firebase-admin

• "but it keeps showing project A default database for both Apps". I don't know what this means. What specifically are you observing here? Do you have code that reproduces the behavior you don't understand? – Doug Stevenson Commented Mar 9, 2019 at 17:21
• Try setting the projectId option in the app options (especially in the secondaryAppConfig). – Hiranya Jayathilaka Commented Mar 9, 2019 at 22:15
• @DougStevenson: what I meant by showing same database is: that if I console log the primarydb and secondarydb, the resulting object shows project-id as the same viz. project-a-id – RmR Commented Mar 10, 2019 at 5:32
• Thanks @HiranyaJayathilaka: when I add projectId:project-b-id in secondaryAppConfig I get a permission error. I must mention that if I download the private key of the default service account from the project-b settings from firebase console it works by passing it as credentials in secondaryAppConfig. But fail to understand why when I set the project-a default service account in IAM of project-b it does not work. – RmR Commented Mar 10, 2019 at 5:40
• 1 This is the error: Error: 7 PERMISSION_DENIED: Missing or insufficient permissions. – RmR Commented Mar 10, 2019 at 5:43

2 Answers 2

I have a cloud-native firestore as opposed to a real-time database in project-a. However, was facing the same issue when I tried to access it from project-b.
Was able to solve it by generating a service account with access to project-a firestore, downloading the credentials and accessing the same from project-b with the following:

credential_path = "pathTo/xxxxx.json"
db = firestore.Client.from_service_account_json(credential_path)

You need to create apps within current firebase project.

Firebase Console -> Project Setting -> General -> Add App

These apps will have access to same firestore but will be deployed seperately under different subdomains(under firebaseapp.).