Are you sure you don't have something misconfigured? By default Cloud Run services their project's GCE service account, which has permissions to everything in t

Are you sure you don't have something misconfigured? By default Cloud Run services their project's GCE service account, which has permissions to everything in the project: https://cloud.google.com/run/docs/securing/service-identity https://cloud.google.com/run/docs/securing/service-identity I've never had to do anything special to access Firestore for instance.