title: Authenticated Cloud Functions: Insufficient permission to access Firestore
body: <p>I am setting up authenticated Cloud Functions for a function-function call as per this <a href="https://cloud.google.com/functions/docs/securing/authenticating#function-to-function" rel="nofollow noreferrer">doc</a>. In my use case, the calling function is CF1 while the receiving function is CF2</p>
  
  <p>I have set up and assign a service account (<code>my-func-invoker@myproject.iam.gserviceaccount.com</code>) for CF1, and setup/assign the Cloud Functions Invoker role for CF2 to the said <code>my-func-invoker@myproject.iam.gserviceaccount.com</code> service account. All is good, CF1 can call CF2 with no problem.</p>
  
  <p>However in CF1, there are 2 workflows:</p>
  
  <ol>
  <li>Invoke CF2</li>
  <li>Read/Write to Firestore</li>
  </ol>
  
  <p>After assigning the service account to CF1, CF1 lost permission to read/write Firestore (my firestore currently grants all read write access) and throws the <code>7 PERMISSION_DENIED: Missing or insufficient permissions.</code> error.</p>
  
  <p>Is there something I am missing?</p>