DEV Community

How to backup your Firestore data automatically

Julien Landuré on August 01, 2019

With my team, we use a lot of Firebase features like Firestore. But there is no simple way to backup the data regularly. We created a tiny Docker...

Read full post

blaquiere guillaume • Oct 14 '19 • Edited

Thanks for this great idea!

However, I'm skeptical about security management:

The service account has to have owner role? It's not too much?
Why adding the other roles if the service account is owner?
This highly granted role is simply base64 encoded and let in "clear" in environment variable!

Why do not simply consider this:

Rely on Cloud Run identity and grant the sufficient role on it
If you really need an additional/external service account, you maybe can consider berglas. If your code is in Go or in Python, you can easily use it (I wrote the Python lib for reading secrets from bucket)

Julien Landuré Zenika • Oct 27 '19

Hi Guillaume 👋

Thanks for your feedback. 👍
I invite you to report the error on the github of the project here.

For the service account and the ownerrole, I just followed the documentation here.
Perhaps we could use the Cloud Run service account.

This first tutorial on "how to backup your Firestore data" is described to show a simple usecase. I understand your advices on security management. Your idea to use KMS is interesting.

Thank you.

blaquiere guillaume • Oct 27 '19

I created the issue #7 and the pull request #8

Security still can be higher, with private Cloud Run, and Cloud Scheduler with a service account identity and the role run.invoker granted on it for calling the Cloud Run.

Unrelated comment: I hope you enjoy your GDE Summit weekend!

Best
Guillaume

Daniel Krause • Aug 20 '19

I am getting an error when hitting the list page
2019-08-20 13:21:49.832 SASTERROR: (gcloud.beta.firestore.operations.list) PERMISSION_DENIED: The caller does not have permission

firebase-backup@xxxxxx.gserviceacc... firebase-backup
Cloud Datastore Import Export Admin
Cloud Datastore Owner
Owner
Storage Admin

Julien Landuré Zenika • Aug 20 '19

Hi Daniel 👋

Thanks for your feedback. 👍
I invite you to report the error on the github of the project here

Perhaps you didn't enable the APIs 🤔
Be careful, like written in the docs, Only GCP projects with billing enabled can use the export and import functionality. Are you using the Spark Plan on Firebase? 😇

Please answer if you find a solution to share the solution to the community. 🙌