已授予 Firebase 擴充功能的權限
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
為讓 Firebase Extension 執行指定動作，Firebase 會透過服務帳戶，授予已安裝擴充功能的每個例項有限的專案和資料存取權。
什麼是服務帳戶？
服務帳戶是一種特殊的 Google 使用者帳戶，代表有權透過 Google API 存取資料的非真人使用者。
安裝擴充功能時，Firebase 會在專案中建立服務帳戶。每個已安裝的擴充功能執行個體都有自己的服務帳戶。
Firebase 會為擴充功能的服務帳戶指派特定角色 (權限組合)，藉此限制專案和資料的存取權。擴充功能運作所需的角色是由 Firebase 在擴充功能開發期間決定。安裝時，Firebase 會將這些角色指派給擴充功能的服務帳戶，您不應修改、新增或刪除任何指派的角色 (否則已安裝的擴充功能將無法正常運作)。不過，您可以解除安裝擴充功能，這樣一來，服務帳戶 (及其存取權) 就會一併刪除。
為擴充功能建立的服務帳戶格式為：
ext-extension-instance-id@project-id.iam.gserviceaccount.com。
如要查看與 Firebase 專案相關聯的所有服務帳戶，請前往「settings 專案設定」的「服務帳戶」分頁。
權限與角色
開發擴充功能時，Firebase 會判斷擴充功能運作所需的存取層級。
Firebase 會明確列出 Firebase 應在安裝擴充功能期間，指派給擴充功能服務帳戶的角色 (權限組合)，藉此定義存取層級。
每個角色 (及其固有權限) 都以特定產品或服務為基礎。角色範例包括 firebasehosting.admin、bigquery.dataEditor 和 firebasedatabase.admin。Firebase 會在擴充功能的規格檔案 (extension.yaml 檔案) 中列出擴充功能所需的角色。
如果是官方 Firebase 擴充功能，Firebase 會徹底檢查這份角色清單，確保擴充功能的存取權嚴格限制在擴充功能工作範圍內。您也可以在Firebase Extensions資訊主頁查看擴充功能的詳細資料頁面，或查看其README檔案，自行檢查並確認授予擴充功能的存取權。
瞭解各角色包含的權限：
解除安裝擴充功能會怎麼樣？
從專案解除安裝擴充功能時，Firebase 會刪除為該擴充功能執行個體建立的服務帳戶。刪除服務帳戶後，擴充功能就無法在專案中執行，因為擴充功能不再擁有專案或資料的存取權。
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-07-25 (世界標準時間)。
[null,null,["上次更新時間：2025-07-25 (世界標準時間)。"],[],[],null,["\u003cbr /\u003e\n\nFor a Firebase Extension to perform its specified actions, Firebase\ngrants each instance of an installed extension limited access to your project\nand data via a ***service account***.\n\nWhat's a service account?\n\n**A\n[service account](//cloud.google.com/iam/docs/understanding-service-accounts)\nis a special type of Google user account. It represents a non-human user that's\nauthorized to access data using Google APIs.**\n\nDuring installation of an extension, Firebase creates a service account in your\nproject. Each installed instance of an extension has its own service account.\n\nFirebase limits access to your project and data by assigning an extension's\nservice account specific [***roles*** (bundles of\npermissions)](/docs/projects/iam/roles). The roles that an extension requires to\noperate are determined by Firebase during extension development. At\ninstallation, Firebase assigns these roles to an extension's service account,\nand you shouldn't modify, add to, or delete any of these assigned roles\n(otherwise your installed extension won't work as expected). You can, though,\n[uninstall the extension](#uninstall-extension), which deletes the service\naccount (and its access) altogether.\n\nService accounts created for extensions are in the format:\n**ext-** \u003cvar translate=\"no\"\u003eextension-instance-id\u003c/var\u003e***@*** \u003cvar translate=\"no\"\u003eproject-id\u003c/var\u003e**.iam.gserviceaccount.com**.\n\nYou can view all the service accounts associated with your Firebase project in\nthe\n[*Service accounts*](//console.firebase.google.com/project/_/settings/serviceaccounts/adminsdk)\ntab of your\nsettings *Project settings*.\n\nPermissions and roles\n\nDuring development of an extension, Firebase determines the level of access that\nan extension requires to operate.\n\nFirebase defines this level of access by explicitly listing the ***roles***\n(bundles of permissions) that Firebase should assign to the extension's\n[service account](#service-account) during installation of the extension.\n\nEach role (and its inherent permissions) is based on a specific product or\nservice. Examples of roles are `firebasehosting.admin`, `bigquery.dataEditor`,\nand `firebasedatabase.admin`. Firebase lists the required roles for an extension\nin the extension's specification file (the\n[`extension.yaml` file](/docs/extensions/overview-use-extensions#view-source-code)).\n\nFor official Firebase extensions, Firebase thoroughly reviews this list of\nroles to ensure that an extension's access is strictly limited to the scope of\nthe extension's tasks. You can also review and confirm for yourself the access\ngranted to an extension by viewing the extension's details page in the\n[Firebase Extensions dashboard](https://console.firebase.google.com/project/_/extensions/) or viewing its\n[`README` file](/docs/extensions/overview-use-extensions#view-source-code).\n\nLearn about the permissions included in each role:\n\n- [Firebase product-level roles](/docs/projects/iam/roles-predefined-product)\n- [Google Cloud\n roles](//cloud.google.com/iam/docs/understanding-roles#predefined_roles)\n\nWhat happens when I uninstall an extension?\n\nWhen you\n[uninstall an extension](/docs/extensions/manage-installed-extensions#uninstall)\nfrom your project, Firebase deletes the [service account](#service-account)\ncreated for that instance of the extension. After this deletion of the service\naccount, the extension cannot run in your project because it no longer has any\naccess rights to your project or data."]]
