Can cloud functions bypass firestore security rules

Question

I recently developed with the implementation of firestore and firestore security rules.

Certain authenticated users can grab data if they are created by them, was one of the feature of the app.

i.e, A creates X B creates Y A can't access Y and B can't access X.

This is ensured using security rules.

I deployed the app with cloud functions, and this acts as an api.

Simulating the security rules passes without failure, but when called the api for accessing via tool like postman, A can access Y and X and B can access X and Y.

I read this stack overflow question that talks about overwriting the security rule if used by firebase-admin sdk, which is what I am using.

But i am just curious, is there any other ways to restrict outside api tools to fetch data like this?

Here is the link

Answer 1

All access to Firebase and Cloud products (Realtime Database, Cloud Firestore, Cloud Functions) coming from any backend SDK will bypass security rules entirely. This includes the Firebase Admin SDK and any other Cloud SDKs. Security rules only apply to web and mobile client access.