How can I resolve permission errors when importing Firestore data between Firebase projects?

When importing data from a Cloud Storage bucket in one project into the Firestore database of another, you need to ensure that the service account performing the import has permission to read from the bucket. In your case, the error:

PERMISSION_DENIED: Service account does not have access to Google Cloud Storage file: /trasnf-dev-prod

indicates that the relevant service account lacks the necessary permissions to access the export files.

Below are the steps you can follow to resolve the issue:

1. Identify the Service Account used for the Firestore Import

When performing an import, Firestore uses a Google-managed service account in the destination (production) project. Its format is typically:

service-[DESTINATION_PROJECT_NUMBER]@gcp-sa-firestore.iam.gserviceaccount.com

Make sure you retrieve your destination project's number (found in the Google Cloud Console under "Dashboard" or "IAM & Admin").

2. Grant the Storage Permissions on the Source Bucket

Your Cloud Storage bucket (trasnf-dev-prod) is in the source project. This service account (from your production project) must be granted read access to the export files. To do this:

1. Go to the Cloud Storage Bucket:
   In the Google Cloud Console, navigate to the bucket trasnf-dev-prod where your export data is stored.

2. Edit Bucket Permissions (IAM):
   Click on the "Permissions" tab to view the current IAM policies.

3. Add the Service Account:
   Add the Firestore service account from your production project. For the role, assign one of the following:

   • Storage Object Viewer (recommended): Grants read-only access to all objects in the bucket.
   • Alternatively, a custom role with the storage.objects.get permission could also work.

   Example (using Cloud Shell):

   BASHCopied
   gsutil iam ch serviceAccount:service-[DESTINATION_PROJECT_NUMBER]@gcp-sa-firestore.iam.gserviceaccount.com:objectViewer gs://trasnf-dev-prod

   Replace [DESTINATION_PROJECT_NUMBER] with your actual destination project number.

4. Verify the Permissions:
   Confirm that the service account now has the roles/storage.objectViewer permission on the bucket.

3. Re-run the Import Command

Once the permission changes propagate, try running your import command again:

BASHCopied
gcloud firestore import gs://trasnf-dev-prod/2024-12-24T00:30:21_45719 --async

Additional Considerations

• Bucket Name Check:
  Ensure that the bucket name is typed correctly. The error message references /trasnf-dev-prod and sometimes /transf-dev-prod. Double-check for any typos, as they would lead to issues accessing the correct bucket.

• Propagation Delay:
  Changes in IAM permissions might take a few minutes to propagate. If you still encounter permission issues immediately, wait a few minutes and try again.

Following these steps should resolve the permission error and allow the import process to access the exported Firestore data.