Question: Per documentation [Initialize the SDK](https://firebase.google.com/docs/admin/setup?authuser=4#initialize-sdk) I will need to generate `New Private Key` and feed that to the init process at the service. 

```
var admin = require("firebase-admin");

var serviceAccount = require("New Private Key.json");

admin.initializeApp({
  credential: admin.credential.cert(serviceAccount),
  databaseURL: "https://blah.firebaseio.com"
});

```

Is there way at IAM level add trust to `Cloud Run` so it will allowed to access `Firebase services`? I would like to use `admin.credential.applicationDefault()` when I run in the `Cloud Run`.

```
admin.initializeApp({
  credential: admin.credential.applicationDefault(),
  databaseURL: 'https://<DATABASE_NAME>.firebaseio.com'
});

```

Just need a clarification may be I am misreading and it is already doing that.

Answer: 
By implementing the Firebase Authentication you can achieve what you want to do:

First you will need to setup [Firebase Authentication](https://firebase.google.com/docs/auth) in your project and service.

1. Enable in the Cloud IAM API for your project.
2. Authorize the Cloud Run credentials to sign tokens. (This can be done by visiting the IAM & admin page in the Google Cloud console, and granting the Service Account Token Creator role to the Default compute service account.)

But in theory it is included in Cloud Functions, but just to be sure you can make the second step, but depending on the needs of your application it might or not be an overkill if you just want a simple authentication.
Tested instance and it seems running from Cloud Run env SDK was able pull `admin.credential.applicationDefault()`! Amazing how it was simplified! Rolling all my apps to Cloud Run!!! Having experience with Azure/AWS, GCP by far too friendly! Kuddos to GCP!