Get started with Terraform and Firebase

Firebase is beginning to support Terraform. If you're on a team that wants to automate and standardize creating Firebase projects with specific resources provisioned and services enabled, then using Terraform with Firebase can be a good fit for you.

The basic workflow for using Terraform with Firebase includes the following:

  • Creating and customizing a Terraform configuration file (a .tf file) which specifies the infrastructure you want to provision (that is, resources you want to provision and the services you want to enable).

  • Using gcloud CLI commands that interface with Terraform to provision the infrastructure specified in the .tf file.

What can you do with Terraform and Firebase?

The example generalized workflow in this guide is creating a new Firebase project with an Android app. But you can do a lot more with Terraform, such as:

  • Delete and modify existing infrastructure using Terraform.

  • Manage product-specific configuration and tasks using Terraform, like:

    • Enabling Firebase Authentication sign-in providers.
    • Creating Cloud Storage buckets or database instances and deploying Firebase Security Rules for them.

You can use standard Terraform config files and commands to accomplish all these tasks. And to help you with this, we've provided sample Terraform config files for several common use cases.


Generalized workflow for using Terraform with Firebase

Prerequisites

This guide is an introduction to using Terraform with Firebase, so it assumes basic proficiency with Terraform. Make sure that you've completed the following prerequisites before starting this workflow.

  • Install Terraform and familiarize yourself with Terraform using their official tutorials.

  • Install the Google Cloud CLI (gcloud CLI). Login using a user account or a service account.

Step 1: Create and customize a Terraform config file

A Terraform config file needs two main sections (which are described in detail below):

Set up your provider

A provider setup is required no matter which Firebase products or services are involved.

  1. Create a Terraform config file (like main.tf file) in your local directory.

    In this guide, you'll use this config file to specify both the provider setup and all the infrastructure that you want Terraform to create. Note, though, that you have options for how to include the provider setup.

  2. Include the following provider setup at the top of the main.tf file.

    You must use the google-beta provider because this is a beta release of using Firebase with Terraform. Exercise caution when using in production.

    # Terraform configuration to set up providers by version.
terraform {
  required_providers {
    google-beta = {
      source  = "hashicorp/google-beta"
      version = "~> 6.0"
    }
  }
}

# Configures the provider to use the resource block's specified project for quota checks.
provider "google-beta" {
  user_project_override = true
}

# Configures the provider to not use the resource block's specified project for quota checks.
# This provider should only be used during project creation and initializing services.
provider "google-beta" {
  alias = "no_user_project_override"
  user_project_override = false
}

    Learn more about the different types of project-related attributes (including what this guide calls the "quota-check project") when using Terraform with Firebase.

  3. Continue to the next section to complete your config file and specify what infrastructure to create.

Specify what infrastructure to create using resource blocks

In your Terraform config file (for this guide, your main.tf file), you need to specify all the infrastructure you want Terraform to create (meaning all the resources you want to provision and all the services you want to enable). In this guide, find a full list of all Firebase resources that support Terraform.

  1. Open your main.tf file.

  2. Under the provider setup, include the following config of resource blocks.

    This basic example creates a new Firebase project and then creates a Firebase Android App within that project.

    # Terraform configuration to set up providers by version.
...

# Configures the provider to use the resource block's specified project for quota checks.
...

# Configures the provider to not use the resource block's specified project for quota checks.
...

# Creates a new Google Cloud project.
resource "google_project" "default" {
  provider   = google-beta.no_user_project_override

  name       = "Project Display Name"
  project_id = "project-id-for-new-project"
  # Required for any service that requires the Blaze pricing plan
  # (like Firebase Authentication with GCIP)
  billing_account = "000000-000000-000000"

  # Required for the project to display in any list of Firebase projects.
  labels = {
    "firebase" = "enabled"
  }
}

# Enables required APIs.
resource "google_project_service" "default" {
  provider = google-beta.no_user_project_override
  project  = google_project.default.project_id
  for_each = toset([
    "cloudbilling.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "firebase.googleapis.com",
    # Enabling the ServiceUsage API allows the new project to be quota checked from now on.
    "serviceusage.googleapis.com",
  ])
  service = each.key

  # Don't disable the service if the resource block is removed by accident.
  disable_on_destroy = false
}

# Enables Firebase services for the new project created above.
resource "google_firebase_project" "default" {
  provider = google-beta
  project  = google_project.default.project_id

  # Waits for the required APIs to be enabled.
  depends_on = [
    google_project_service.default
  ]
}

# Creates a Firebase Android App in the new project created above.
resource "google_firebase_android_app" "default" {
  provider = google-beta

  project      = google_project.default.project_id
  display_name = "My Awesome Android app"
  package_name = "awesome.package.name"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.default,
  ]
}

Step 2: Run Terraform commands to create the specified infrastructure

To provision the resources and enable the services specified in your main.tf file, run the following commands from the same directory as your main.tf file. For detailed information about these commands, see the Terraform documentation.

  1. If this is the first time that you're running Terraform commands in the directory, you need to initialize the configuration directory and install the Google Terraform provider. Do this by running the following command:

    terraform init

  2. Create the infrastructure specified in your main.tf file by running the following command:

    terraform apply

  3. Confirm that everything was provisioned or enabled as expected:

    • Option 1: See the configuration printed in your terminal by running the following command:

      terraform show

    • Option 2: View your Firebase project in the Firebase console.


Firebase resources with Terraform support

The following Firebase and Google resources have Terraform support. And we're adding more resources all the time! So if you don't see the resource that you want to manage with Terraform, then check back soon to see if it's available or request it by filing an issue in the repo.

Firebase project and app management

  • google_firebase_project — enable Firebase services on an existing Google Cloud project

  • Firebase Apps

Firebase Authentication

Not yet supported:

  • Configuring multi-factor authentication (MFA) via Terraform

Firebase Data Connect

Firebase Realtime Database

Not yet supported:

  • Deploying Firebase Realtime Database Security Rules via Terraform (learn how to deploy these Rules using other tooling, including programmatic options)

Cloud Firestore

  • google_firestore_database — create a Cloud Firestore instance

  • google_firestore_index — enable efficient queries for Cloud Firestore

  • google_firestore_document — seed a Cloud Firestore instance with a specific document in a collection

    Important: Do not use real end-user or production data in this seed document.

Cloud Storage for Firebase

Firebase Security Rules (for Cloud Firestore and Cloud Storage)

Note that Firebase Realtime Database uses a different provisioning system for its Firebase Security Rules.

  • google_firebaserules_ruleset — define Firebase Security Rules that apply to a Cloud Firestore instance or a Cloud Storage bucket

  • google_firebaserules_release — deploy specific rulesets to a Cloud Firestore instance or a Cloud Storage bucket

Firebase App Check

Firebase Extensions


Sample Terraform config files for common use cases


Troubleshooting and FAQ