In order to use the Firebase Admin SDK in v2 Firebase Cloud Functions, one must grant the “Default compute service account” in Google Cloud console the “Firebase Admin SDK Administrator Service Agent” role. This is because v2 functions use this service account to access the Firebase Admin SDK and not the “firebase-adminsdk” service account that was automatically created with that aforementioned role.

Is it safe to grant the default compute engine service account this role? Or is there a way to force v2 functions to use the firebase-adminsdk service account instead?