I’m trying to authenticate the Firebase admin SDK in Node.js using Workload Identity Federation credentials with AWS.

Here’s the relevant part of my configuration:

{
  "type": "external_account",
  "audience": "//iam.googleapis.com/<identity_pool_provider_identifier>",
  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/<service_account_email>:generateAccessToken",
  "token_url": "https://sts.googleapis.com/v1/token",
  ...
}

The format of this file is specified in AIP-4117.

According to this issue, it is now possible to use credentials of type external_account when using applicationDefault().

I made sure that the GOOGLE_APPLICATION_CREDENTIALS variable is populated correctly.

I tried using the following code:

const firebase = admin.initializeApp({
      credential: admin.credential.applicationDefault(),
      projectId: process.env.GOOGLE_PROJECT_ID,
    });

firebase
      .messaging()
      .send({ /* ... notification payload ... */);

… which gives this error: Credential implementation provided to initializeApp() via the "credential" property failed to fetch a valid Google OAuth2 access token with the following error: "The caller does not have permission"..

I highly doubt I am missing permissions, since I was using the lower-level google-auth-library client to use Firebase Cloud Messaging, and it worked fine for months.
Now that the Firebase admin SDK supports external account credentials, I wanted to give it a try to be able to use all the features, but I am having this issue.

Anything I might be missing, or doing wrong?

Any help is appreciated. Thanks!