In firebase-admin v12.2.0, roles/serviceusage.serviceUsageConsumer is now required in IAM, but is this officially documented?

[akabekobeko]

From the PR and Issue below, I determined that roles/serviceusage.serviceUsageConsumer is now required for IAM in firebase-admin v12.2.0.
However, I could not find any explanation in the Firebase Admin SDK documentation. Is this specification change official?

• Release Firebase Admin Node.js SDK v12.2.0 · firebase/firebase-admin-node
• fix: Make ADC + human account work with firebase-admin by foxrafa · Pull Request #2553 · firebase/firebase-admin-node
• grpc connection fails on firestore/auth due to ssl bad signature errors · Issue #2609 · firebase/firebase-admin-node

If you call Firebase Admin's auth().createSessionCookie() without adding this role, the following error will occur (the message has been edited for readability):

Caller does not have required permission to use project xxx.

Grant the caller the roles/serviceusage.serviceUsageConsumer role,
or a custom role with the serviceusage.services.use permission,
by visiting https://console.developers.google.com/iam-admin/iam/project?project=xxx

and then retry. Propagation of the new permission may take a few minutes.

Looking at the error message and the content of the issue, it seems to be within the specifications. However, serviceusage.serviceUsageConsumer is a powerful permission. Therefore, I would like to avoid applying it when it is not listed in the official documentation.

Therefore, I posted a question about whether it is official or not.

[akabekobeko]

Roles are no longer necessary in v13, so the discussion will be closed.

• Release Firebase Admin Node.js SDK v13.0.0 · firebase/firebase-admin-node
• Upgrading firebase-admin requires additional serviceUsageConsumer permissions · Issue #2658 · firebase/firebase-admin-node