title: Invalid resource field value in the request
body: <p>I'm using the Go SDK @ cloud.google.com/go/firestore <a href="https://pkg.go.dev/cloud.google.com/go/firestore" rel="nofollow noreferrer">GoDoc here</a> to call Firestore. It works great on App Engine, but I recently added a new service to Cloud Run. This new service calls into the same code used by the old service, but that code - which works on App Engine - is throwing an error on Cloud Run: <code>rpc error: code = InvalidArgument desc = Invalid resource field value in the request</code></p>
  <p>The particular line of code throwing the error is:</p>
  <pre><code>snap, err := client.Collection(queryable.CollectionName()).Doc(queryable.GetFirestoreID()).Get(ctx)
  if err != nil {
      return fmt.Errorf(&quot;couldn't read document with id: %v error: %w&quot;, queryable.GetFirestoreID(), err)
  }
  </code></pre>
  <p>Where queryable is an interface and CollectionName() returns a constant string so can't be the problem (besides if that was the problem it would return a different error).</p>
  <p>I wrap error messages with more text, so the full error message can give you a sense of the stack: <code>DoTaxDog: allDB.UpdateData: firestoreCRUD.ReadSchema: error in Firestore's ReadSchema: couldn't read document with id: AGPFiyoJdMAmurVNqHYxvKHEb error: rpc error: code = InvalidArgument desc = Invalid resource field value in the request.</code>
  The <code>allDB.UpdateData</code> function is shared between this code and the code which is running in App Engine, so for all intents and purposes the code I'm running on App Engine and the code I'm running on Cloud Run is identical.</p>
  <h2>Deployment Information</h2>
  <p>I deploy with this in Gitlab:</p>
  <pre><code>deploy_run:
    image: google/cloud-sdk
    stage: deploy
    only:
      - master
    script:
      - echo $DEPLOY_KEY &gt; /tmp/$CI_PIPELINE_ID.json
      - gcloud auth activate-service-account --key-file /tmp/$CI_PIPELINE_ID.json
      - gcloud builds submit --tag gcr.io/project-name/project-name --project project-name
      - gcloud run deploy project-name --image gcr.io/project-name/project-name --platform managed --project project-name --region=us-central1 --allow-unauthenticated
  </code></pre>
  <h2>Attempts to solve the problem</h2>
  <ol>
  <li>I tried re-running the request. No dice.</li>
  <li>I checked that the same request was working on localhost. It is working on localhost.</li>
  <li>I checked that I'm able to make requests (not the same request, but an almost identical request) on App Engine. It is still working on App Engine.</li>
  <li>I checked the GoDoc. It does not reference this error.</li>
  <li>I checked Google Cloud docs. They seem to say this is a generic error message. I couldn't find a specific reference to this error message for Firestore.</li>
  <li>I searched for an answer online. No dice.</li>
  </ol>
  <h2>Infrastructure Checks</h2>
  <ul>
  <li>App Engine and Cloud Run are in the same region.</li>
  <li>I think that both are using the default app engine service account to service requests, because on the Cloud Run service page it is giving me a security warning: &quot;Cloud Run service [censored] in us-central1 is using the default Compute Engine service account. By default, this service account has broad IAM permissions.&quot;</li>
  <li>I tried re-deploying with different service accounts (Edit &amp; Deploy New Revision &gt; Security Tab &gt; Change Service Account &gt; click &quot;Deploy&quot;). I tried the default app engine service account and the compute engine service account. In both cases, invoking the service resulted in the error in this post.</li>
  </ul>
  <p>I've had this problem before, but I can't remember how I solved it last time so I'm making this post.</p>