title: How can I authorize Cloud Build to deploy to Firebase Hosting in a different project?
body: <p>I have GCP project <code>A</code> and Firebase project <code>B</code> (in a separate GCP project). I'm trying to use Cloud Build in <code>A</code> to build a web app and deploy it to Firebase Hosting in <code>B</code>.</p>
  <p>In <code>B</code>'s IAM page, I have granted <code>A</code>'s <code>&lt;id&gt;@cloudbuild.gserviceaccount.com</code> service account the <code>API Keys Admin</code>, <code>Firebase Admin</code>, and <code>Service Account User</code> roles as described in e.g. <a href="https://stackoverflow.com/questions/62676357/proper-permission-for-cloud-build-to-deploy-to-firebase">this question</a>.</p>
  <p>The final step in the Cloud Build config used by <code>A</code> is the following:</p>
  <pre class="lang-yaml prettyprint-override"><code>  - id: firebase_deploy
      name: gcr.io/$PROJECT_ID/firebase
      entrypoint: sh
      args:
        - '-c'
        - |
          firebase use $_FIREBASE_PROJECT_ID
          firebase target:apply hosting prod $_FIREBASE_HOSTING_TARGET
          firebase deploy --project=$_FIREBASE_PROJECT_ID --only=hosting,firestore:rules
  </code></pre>
  <p>I set the <code>_FIREBASE_PROJECT_ID</code> substitution variable to <code>B</code> and the <code>_FIREBASE_HOSTING_TARGET</code> variable to a Hosting alias that I use for the site.</p>
  <p>When I trigger a build, it fails with the following error:</p>
  <pre><code>...
  Step #3 - &quot;firebase_deploy&quot;: Error: Invalid project selection, please verify project B exists and you have access.
  Step #3 - &quot;firebase_deploy&quot;:
  Step #3 - &quot;firebase_deploy&quot;: Error: Must have an active project to set deploy targets. Try firebase use --add
  Step #3 - &quot;firebase_deploy&quot;:
  Step #3 - &quot;firebase_deploy&quot;: Error: Failed to get Firebase project B. Please make sure the project exists and your account has permission to access it.
  Finished Step #3 - &quot;firebase_deploy&quot;
  </code></pre>
  <p>I suspect that the problem may be that I'm not running the Firebase CLI's extra login step first. To do that, it seems that I would need to run <code>firebase login:ci</code> locally to generate a token and then pass it via the <code>FIREBASE_TOKEN</code> environment variable <a href="https://github.com/firebase/firebase-tools#using-with-ci-systems" rel="nofollow noreferrer">as described in the docs</a>, but the permissions associated with the token appear to be much broader than needed:</p>
  <p><a href="https://i.stack.imgur.com/ebsGp.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ebsGp.png" alt="screenshot from token generation page" /></a></p>
  <p>The build process should only have access to Firebase project <code>B</code>, rather than &quot;all my Firebase data and settings&quot; and &quot;my Google Cloud data&quot;.</p>
  <ol>
  <li>Is there any way to avoid needing to run <code>firebase login</code> here? It seems like the service account should already have sufficient access to deploy to Firebase Hosting.</li>
  <li>If I need to run <code>firebase login</code>, is there any way to create a token with a limited scope (assuming that my understanding of the default scope is correct)?</li>
  </ol>
  <p>(I've also given <code>B</code>'s service account the <code>Cloud Functions Developer</code> role in <code>A</code> and am able to successfully run <code>gcloud --project=$_FIREBASE_PROJECT_ID functions deploy ...</code> in a different build config. I'm also using a Cloud Build config similar to the one described above to deploy to Firebase Hosting in the same GCP project, so I suspect that <code>firebase login</code> isn't necessary in all cases.)</p>