Firebase Cloud Functions Deployment Fails: " <number>[email protected] not found" after Default Service Account Deletion

Question

Problem:

I'm encountering an error when deploying Firebase Cloud Functions:

Error: <number>[email protected] not found

This error occurred after the default Compute Engine service account, <number>[email protected], was deleted more than 30 days ago.

I understand that after 30 days, service accounts are permanently deleted and cannot be recovered.

Attempts to Resolve:

• Re-enabling Compute Engine API:

  • I re-enabled the Compute Engine API for my project

    • But this did not restore the deleted service account.

• Setting a New Default Service Account:

  • I attempted to set a new default Compute Engine service account through the Compute Engine metadata.

    • However, the Firebase CLI continues to attempt to use the deleted <number>[email protected].

Questions:

1. How can I restore the <number>[email protected] account?

2. How can I configure the Firebase CLI to use a newly created or existing service account for Cloud Functions deployment instead of the deleted default?

Is there a way to override the default service account that the Firebase CLI is trying to use at the project level?

Relevant Information:

I am using Firebase deploy pipe from atlassian to deploy my cloud functions(Bitbucket)

In the pipe I am setting the KEY_FILE to use a specific service account for deployment

Yet the included key for the service account is not being used, still searching for the default compute engine

[2025-04-03T08:41:06.826Z] <<< [apiv2][body] GET https://us.gcr.io/v2/<project-id>/gcf/us-central1/tags/list {"child":[],"manifest":{},"name":"<project-id>/gcf/us-central1","tags":[]}

"message": "HTTP Error: 404, Service account projects/-/serviceAccounts/<uid>[email protected] was not found.",

Expected Behavior:

I expect the Firebase CLI to successfully deploy Cloud Functions using a valid, existing service account.

Actual Behavior:

The deployment fails with the " <number>[email protected] not found" error.

Additional Notes:

I suspect the Firebase CLI is hardcoded to use the original, now-deleted default service account. I'm looking for a way to explicitly specify a service account for Cloud Functions deployment.

Answer 1

GCP TSE is here to help you with your situation 🤞.

1. How can I restore the <number>[email protected] account?

You're right - as per Google Cloud Docs [1] you can't restore your Service Account (SA), because after 30 days, IAM permanently removes it.

2. How can I configure the Firebase CLI to use a newly created or existing service account for Cloud Functions deployment instead of the deleted default?

Firebase CLI has several ways [2] to authenticate to API: using the Application Default Credentials (ADC) or using FIREBASE_TOKEN (considered legacy). You might have some kind of custom setup, but in general to authenticate Firebase CLI with a SA you should follow this simple guide [3]:

1. Locate an existing SA or create a new one to be used by Firebase CLI;
2. Grant all required roles to this SA (explained in [3], but you might need more narrow roles for your specific case);
3. Setup ADC depending on your environment;
4. Update the GOOGLE_APPLICATION_CREDENTIALS OS environment variable using gcloud auth application-default login or manually (depending on your dev environment). Details are in the linked docs.

[1] https://cloud.google.com/iam/docs/service-accounts-delete-undelete#undeleting
[2] https://firebase.google.com/docs/cli#cli-ci-systems
[3] https://firebase.google.com/docs/app-distribution/authenticate-service-account
[4] https://cloud.google.com/docs/authentication/provide-credentials-adc

---

If you haven't solved your problem using the above guide, please explain your deployment process stp-by-step. Also, try to answer as much as possible:

• What you're inserting as a value for the `KEY_FILE' key?
• Are you using both KEY_FILE and FIREBASE_TOKEN keys simultaneously?
• Are you using the PROJECT_ID key?