I have a node app that uses the firebase sdk to read/write to a firestore db.

  "dependencies": {
    "firebase": "^9.12.1",
    "firebase-admin": "^10.0.2",
  },

import admin = require('firebase-admin');
import { initializeApp } from 'firebase-admin/app';

const app = initializeApp({
  credential: admin.credential.cert({
    "type": "service_account",
    "project_id": ...,
    "private_key_id": ...,
    "private_key": ...,
    "client_email": "[email protected]",
    "client_id": ...,
    "auth_uri": "https://accounts.google.com/o/oauth2/auth",
    "token_uri": "https://oauth2.googleapis.com/token",
    "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
    "client_x509_cert_url": ...
  } as any
  )
});
let db = admin.firestore();

This app is able to read/write to firestore just fine if my security rules are totally open:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
     allow read: if true
     allow write: if true
    }
  }
}

However, I want to restrict read/write access only to the service account specified during app initializiation (“[email protected]”).

Do I need to add anything to my security rules to restrict access just to this service account? Or is that done implicitly by firestore?