部署Firebase Function权限问题：缺失firebaseextensions.instances.list权限如何解决

我正在修改他人的旧项目，该项目后端完全基于Firebase，需要部署Firebase Function。目前我已拥有Cloud Functions Admin角色，但部署新函数时仍遇到权限问题：项目启用了Firebase Extensions API，系统提示我缺少firebaseextensions.instances.list权限（我确实没有该权限）。想请教：

• 是否存在多余操作？
• 还是只需申请额外权限？
• 若需申请，哪些是必要权限？

错误日志 #

[2025-02-13T00:41:06.406Z] >>> [apiv2][query] POST https://cloudresourcemanager.googleapis.com/v1/projects/xxx-123xxx-123:testIamPermissions [none]
[2025-02-13T00:41:06.406Z] >>> [apiv2][(partial)header] POST https://cloudresourcemanager.googleapis.com/v1/projects/xxx-123xxx-123:testIamPermissions x-goog-quota-user=projects/xxx-123xxx-123
[2025-02-13T00:41:06.407Z] >>> [apiv2][body] POST https://cloudresourcemanager.googleapis.com/v1/projects/xxx-123xxx-123:testIamPermissions {"permissions":["firebase.projects.get","firebaseextensions.instances.list"]}
[2025-02-13T00:41:07.222Z] <<< [apiv2][status] POST https://cloudresourcemanager.googleapis.com/v1/projects/xxx-123xxx-123:testIamPermissions 200
[2025-02-13T00:41:07.222Z] <<< [apiv2][body] POST https://cloudresourcemanager.googleapis.com/v1/projects/xxx-123xxx-123:testIamPermissions {"permissions":["firebase.projects.get"]}
[2025-02-13T00:41:07.223Z] [iam] error while checking permissions, command may fail: Authorization failed. This account is missing the following required permissions on project xxx-123xxx-123:

  firebaseextensions.instances.list
[2025-02-13T00:41:07.223Z] Checked if tokens are valid: true, expires at: 1739408440576
[2025-02-13T00:41:07.224Z] Checked if tokens are valid: true, expires at: 1739408440576
[2025-02-13T00:41:07.225Z] >>> [apiv2][query] GET https://firebaseextensions.googleapis.com/v1beta/projects/xxx-123xxx-123/instances pageSize=100&pageToken=
[2025-02-13T00:41:08.095Z] <<< [apiv2][status] GET https://firebaseextensions.googleapis.com/v1beta/projects/xxx-123xxx-123/instances 403
[2025-02-13T00:41:08.095Z] <<< [apiv2][body] GET https://firebaseextensions.googleapis.com/v1beta/projects/xxx-123xxx-123/instances {"error":{"code":403,"message":"The caller does not have permission","status":"PERMISSION_DENIED"}}

Error: Request to https://firebaseextensions.googleapis.com/v1beta/projects/xxx-123xxx-123/instances?pageSize=100&pageToken= had HTTP Error: 403, The caller does not have permission
[2025-02-13T00:41:08.189Z] Error Context: {
  "body": {
    "error": {
      "code": 403,
      "message": "The caller does not have permission",
      "status": "PERMISSION_DENIED"
    }
  },
  "response": {
    "statusCode": 403
  }
}

• 无多余操作：Firebase CLI部署Functions时，会自动校验项目关联的Firebase Extensions资源，这是CLI内置流程，和你的操作无关。
• 需申请额外权限：根据报错，必须补充firebaseextensions.instances.list权限才能完成部署。
• 必要权限选择：
  • 仅部署Functions、不涉及Extensions管理：仅添加firebaseextensions.instances.list权限即可（建议通过自定义IAM角色实现最小权限原则）；
  • 后续需要管理Extensions（安装、配置等）：可添加Firebase Extensions Admin角色，该角色包含所有Extensions相关权限，但如果只是部署Functions，优先选最小权限。

内容的提问来源于stack exchange，提问作者Facundo