firebasegoogle-cloud-platformdeploymentgoogle-cloud-functionsgoogle-compute-engine

Firebase Cloud Functions Deployment Fails: " <number>-compute@developer.gserviceaccount.com not found" after Default Service Account Deletion

Problem:

I'm encountering an error when deploying Firebase Cloud Functions:

Error: <number>-compute@developer.gserviceaccount.com not found

This error occurred after the default Compute Engine service account, <number>-compute@developer.gserviceaccount.com, was deleted more than 30 days ago.

I understand that after 30 days, service accounts are permanently deleted and cannot be recovered.

Attempts to Resolve:

Questions:

  1. How can I restore the <number>-compute@developer.gserviceaccount.com account?

  2. How can I configure the Firebase CLI to use a newly created or existing service account for Cloud Functions deployment instead of the deleted default?

Is there a way to override the default service account that the Firebase CLI is trying to use at the project level?

Relevant Information:

I am using Firebase deploy pipe from atlassian to deploy my cloud functions(Bitbucket)

In the pipe I am setting the KEY_FILE to use a specific service account for deployment

Yet the included key for the service account is not being used, still searching for the default compute engine

[2025-04-03T08:41:06.826Z] <<< [apiv2][body] GET https://us.gcr.io/v2/<project-id>/gcf/us-central1/tags/list {"child":[],"manifest":{},"name":"<project-id>/gcf/us-central1","tags":[]}

"message": "HTTP Error: 404, Service account projects/-/serviceAccounts/<uid>-compute@developer.gserviceaccount.com was not found.",

Expected Behavior:

I expect the Firebase CLI to successfully deploy Cloud Functions using a valid, existing service account.

Actual Behavior:

The deployment fails with the " <number>-compute@developer.gserviceaccount.com not found" error.

Additional Notes:

I suspect the Firebase CLI is hardcoded to use the original, now-deleted default service account. I'm looking for a way to explicitly specify a service account for Cloud Functions deployment.

Solution

  • GCP TSE is here to help you with your situation 🤞.

    1. How can I restore the <number>-compute@developer.gserviceaccount.com account?

    You're right - as per Google Cloud Docs [1] you can't restore your Service Account (SA), because after 30 days, IAM permanently removes it.

    1. How can I configure the Firebase CLI to use a newly created or existing service account for Cloud Functions deployment instead of the deleted default?

    Firebase CLI has several ways [2] to authenticate to API: using the Application Default Credentials (ADC) or using FIREBASE_TOKEN (considered legacy). You might have some kind of custom setup, but in general to authenticate Firebase CLI with a SA you should follow this simple guide [3]:

    1. Locate an existing SA or create a new one to be used by Firebase CLI;
    2. Grant all required roles to this SA (explained in [3], but you might need more narrow roles for your specific case);
    3. Setup ADC depending on your environment;
    4. Update the GOOGLE_APPLICATION_CREDENTIALS OS environment variable using gcloud auth application-default login or manually (depending on your dev environment). Details are in the linked docs.

    [1] https://cloud.google.com/iam/docs/service-accounts-delete-undelete#undeleting
    [2] https://firebase.google.com/docs/cli#cli-ci-systems
    [3] https://firebase.google.com/docs/app-distribution/authenticate-service-account
    [4] https://cloud.google.com/docs/authentication/provide-credentials-adc

    If you haven't solved your problem using the above guide, please explain your deployment process stp-by-step. Also, try to answer as much as possible: