The gcp:firebase/appHostingTraffic:AppHostingTraffic resource, part of the Pulumi GCP provider, controls how production traffic is routed to Firebase App Hosting builds. This guide focuses on three capabilities: manual traffic routing to specific builds, automatic rollouts from Git branches, and pausing automatic deployments.
Traffic configuration requires an existing Firebase App Hosting backend, builds to route to, and a service account with the firebaseapphosting.computeRunner role. The examples are intentionally small. Combine them with your own backend and build resources.
Route traffic to a specific build
When deploying a new version or rolling back to a known-good build, you need explicit control over which build receives production traffic.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
//## Include these blocks only once per project if you are starting from scratch ###
const serviceAccount = new gcp.serviceaccount.Account("service_account", {
project: "my-project-name",
accountId: "firebase-app-hosting-compute",
displayName: "Firebase App Hosting compute service account",
createIgnoreAlreadyExists: true,
});
const fah = new gcp.projects.Service("fah", {
project: "my-project-name",
service: "firebaseapphosting.googleapis.com",
});
const exampleAppHostingBackend = new gcp.firebase.AppHostingBackend("example", {
project: "my-project-name",
location: "asia-east1",
backendId: "traffic-tg",
appId: "1:0000000000:web:674cde32020e16fbce9dbd",
servingLocality: "GLOBAL_ACCESS",
serviceAccount: serviceAccount.email,
}, {
dependsOn: [fah],
});
const exampleAppHostingBuild = new gcp.firebase.AppHostingBuild("example", {
project: exampleAppHostingBackend.project,
location: exampleAppHostingBackend.location,
backend: exampleAppHostingBackend.backendId,
buildId: "target-build",
source: {
container: {
image: "us-docker.pkg.dev/cloudrun/container/hello",
},
},
});
const example = new gcp.firebase.AppHostingTraffic("example", {
project: exampleAppHostingBackend.project,
location: exampleAppHostingBackend.location,
backend: exampleAppHostingBackend.backendId,
target: {
splits: [{
build: exampleAppHostingBuild.name,
percent: 100,
}],
},
});
const appHostingSaRunner = new gcp.projects.IAMMember("app_hosting_sa_runner", {
project: "my-project-name",
role: "roles/firebaseapphosting.computeRunner",
member: serviceAccount.member,
});
import pulumi
import pulumi_gcp as gcp
### Include these blocks only once per project if you are starting from scratch ###
service_account = gcp.serviceaccount.Account("service_account",
project="my-project-name",
account_id="firebase-app-hosting-compute",
display_name="Firebase App Hosting compute service account",
create_ignore_already_exists=True)
fah = gcp.projects.Service("fah",
project="my-project-name",
service="firebaseapphosting.googleapis.com")
example_app_hosting_backend = gcp.firebase.AppHostingBackend("example",
project="my-project-name",
location="asia-east1",
backend_id="traffic-tg",
app_id="1:0000000000:web:674cde32020e16fbce9dbd",
serving_locality="GLOBAL_ACCESS",
service_account=service_account.email,
opts = pulumi.ResourceOptions(depends_on=[fah]))
example_app_hosting_build = gcp.firebase.AppHostingBuild("example",
project=example_app_hosting_backend.project,
location=example_app_hosting_backend.location,
backend=example_app_hosting_backend.backend_id,
build_id="target-build",
source={
"container": {
"image": "us-docker.pkg.dev/cloudrun/container/hello",
},
})
example = gcp.firebase.AppHostingTraffic("example",
project=example_app_hosting_backend.project,
location=example_app_hosting_backend.location,
backend=example_app_hosting_backend.backend_id,
target={
"splits": [{
"build": example_app_hosting_build.name,
"percent": 100,
}],
})
app_hosting_sa_runner = gcp.projects.IAMMember("app_hosting_sa_runner",
project="my-project-name",
role="roles/firebaseapphosting.computeRunner",
member=service_account.member)
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/firebase"
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/projects"
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/serviceaccount"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
// ## Include these blocks only once per project if you are starting from scratch ###
serviceAccount, err := serviceaccount.NewAccount(ctx, "service_account", &serviceaccount.AccountArgs{
Project: pulumi.String("my-project-name"),
AccountId: pulumi.String("firebase-app-hosting-compute"),
DisplayName: pulumi.String("Firebase App Hosting compute service account"),
CreateIgnoreAlreadyExists: pulumi.Bool(true),
})
if err != nil {
return err
}
fah, err := projects.NewService(ctx, "fah", &projects.ServiceArgs{
Project: pulumi.String("my-project-name"),
Service: pulumi.String("firebaseapphosting.googleapis.com"),
})
if err != nil {
return err
}
exampleAppHostingBackend, err := firebase.NewAppHostingBackend(ctx, "example", &firebase.AppHostingBackendArgs{
Project: pulumi.String("my-project-name"),
Location: pulumi.String("asia-east1"),
BackendId: pulumi.String("traffic-tg"),
AppId: pulumi.String("1:0000000000:web:674cde32020e16fbce9dbd"),
ServingLocality: pulumi.String("GLOBAL_ACCESS"),
ServiceAccount: serviceAccount.Email,
}, pulumi.DependsOn([]pulumi.Resource{
fah,
}))
if err != nil {
return err
}
exampleAppHostingBuild, err := firebase.NewAppHostingBuild(ctx, "example", &firebase.AppHostingBuildArgs{
Project: exampleAppHostingBackend.Project,
Location: exampleAppHostingBackend.Location,
Backend: exampleAppHostingBackend.BackendId,
BuildId: pulumi.String("target-build"),
Source: &firebase.AppHostingBuildSourceArgs{
Container: &firebase.AppHostingBuildSourceContainerArgs{
Image: pulumi.String("us-docker.pkg.dev/cloudrun/container/hello"),
},
},
})
if err != nil {
return err
}
_, err = firebase.NewAppHostingTraffic(ctx, "example", &firebase.AppHostingTrafficArgs{
Project: exampleAppHostingBackend.Project,
Location: exampleAppHostingBackend.Location,
Backend: exampleAppHostingBackend.BackendId,
Target: &firebase.AppHostingTrafficTargetArgs{
Splits: firebase.AppHostingTrafficTargetSplitArray{
&firebase.AppHostingTrafficTargetSplitArgs{
Build: exampleAppHostingBuild.Name,
Percent: pulumi.Int(100),
},
},
},
})
if err != nil {
return err
}
_, err = projects.NewIAMMember(ctx, "app_hosting_sa_runner", &projects.IAMMemberArgs{
Project: pulumi.String("my-project-name"),
Role: pulumi.String("roles/firebaseapphosting.computeRunner"),
Member: serviceAccount.Member,
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
//## Include these blocks only once per project if you are starting from scratch ###
var serviceAccount = new Gcp.ServiceAccount.Account("service_account", new()
{
Project = "my-project-name",
AccountId = "firebase-app-hosting-compute",
DisplayName = "Firebase App Hosting compute service account",
CreateIgnoreAlreadyExists = true,
});
var fah = new Gcp.Projects.Service("fah", new()
{
Project = "my-project-name",
ServiceName = "firebaseapphosting.googleapis.com",
});
var exampleAppHostingBackend = new Gcp.Firebase.AppHostingBackend("example", new()
{
Project = "my-project-name",
Location = "asia-east1",
BackendId = "traffic-tg",
AppId = "1:0000000000:web:674cde32020e16fbce9dbd",
ServingLocality = "GLOBAL_ACCESS",
ServiceAccount = serviceAccount.Email,
}, new CustomResourceOptions
{
DependsOn =
{
fah,
},
});
var exampleAppHostingBuild = new Gcp.Firebase.AppHostingBuild("example", new()
{
Project = exampleAppHostingBackend.Project,
Location = exampleAppHostingBackend.Location,
Backend = exampleAppHostingBackend.BackendId,
BuildId = "target-build",
Source = new Gcp.Firebase.Inputs.AppHostingBuildSourceArgs
{
Container = new Gcp.Firebase.Inputs.AppHostingBuildSourceContainerArgs
{
Image = "us-docker.pkg.dev/cloudrun/container/hello",
},
},
});
var example = new Gcp.Firebase.AppHostingTraffic("example", new()
{
Project = exampleAppHostingBackend.Project,
Location = exampleAppHostingBackend.Location,
Backend = exampleAppHostingBackend.BackendId,
Target = new Gcp.Firebase.Inputs.AppHostingTrafficTargetArgs
{
Splits = new[]
{
new Gcp.Firebase.Inputs.AppHostingTrafficTargetSplitArgs
{
Build = exampleAppHostingBuild.Name,
Percent = 100,
},
},
},
});
var appHostingSaRunner = new Gcp.Projects.IAMMember("app_hosting_sa_runner", new()
{
Project = "my-project-name",
Role = "roles/firebaseapphosting.computeRunner",
Member = serviceAccount.Member,
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.serviceaccount.Account;
import com.pulumi.gcp.serviceaccount.AccountArgs;
import com.pulumi.gcp.projects.Service;
import com.pulumi.gcp.projects.ServiceArgs;
import com.pulumi.gcp.firebase.AppHostingBackend;
import com.pulumi.gcp.firebase.AppHostingBackendArgs;
import com.pulumi.gcp.firebase.AppHostingBuild;
import com.pulumi.gcp.firebase.AppHostingBuildArgs;
import com.pulumi.gcp.firebase.inputs.AppHostingBuildSourceArgs;
import com.pulumi.gcp.firebase.inputs.AppHostingBuildSourceContainerArgs;
import com.pulumi.gcp.firebase.AppHostingTraffic;
import com.pulumi.gcp.firebase.AppHostingTrafficArgs;
import com.pulumi.gcp.firebase.inputs.AppHostingTrafficTargetArgs;
import com.pulumi.gcp.projects.IAMMember;
import com.pulumi.gcp.projects.IAMMemberArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
//## Include these blocks only once per project if you are starting from scratch ###
var serviceAccount = new Account("serviceAccount", AccountArgs.builder()
.project("my-project-name")
.accountId("firebase-app-hosting-compute")
.displayName("Firebase App Hosting compute service account")
.createIgnoreAlreadyExists(true)
.build());
var fah = new Service("fah", ServiceArgs.builder()
.project("my-project-name")
.service("firebaseapphosting.googleapis.com")
.build());
var exampleAppHostingBackend = new AppHostingBackend("exampleAppHostingBackend", AppHostingBackendArgs.builder()
.project("my-project-name")
.location("asia-east1")
.backendId("traffic-tg")
.appId("1:0000000000:web:674cde32020e16fbce9dbd")
.servingLocality("GLOBAL_ACCESS")
.serviceAccount(serviceAccount.email())
.build(), CustomResourceOptions.builder()
.dependsOn(fah)
.build());
var exampleAppHostingBuild = new AppHostingBuild("exampleAppHostingBuild", AppHostingBuildArgs.builder()
.project(exampleAppHostingBackend.project())
.location(exampleAppHostingBackend.location())
.backend(exampleAppHostingBackend.backendId())
.buildId("target-build")
.source(AppHostingBuildSourceArgs.builder()
.container(AppHostingBuildSourceContainerArgs.builder()
.image("us-docker.pkg.dev/cloudrun/container/hello")
.build())
.build())
.build());
var example = new AppHostingTraffic("example", AppHostingTrafficArgs.builder()
.project(exampleAppHostingBackend.project())
.location(exampleAppHostingBackend.location())
.backend(exampleAppHostingBackend.backendId())
.target(AppHostingTrafficTargetArgs.builder()
.splits(AppHostingTrafficTargetSplitArgs.builder()
.build(exampleAppHostingBuild.name())
.percent(100)
.build())
.build())
.build());
var appHostingSaRunner = new IAMMember("appHostingSaRunner", IAMMemberArgs.builder()
.project("my-project-name")
.role("roles/firebaseapphosting.computeRunner")
.member(serviceAccount.member())
.build());
}
}
resources:
example:
type: gcp:firebase:AppHostingTraffic
properties:
project: ${exampleAppHostingBackend.project}
location: ${exampleAppHostingBackend.location}
backend: ${exampleAppHostingBackend.backendId}
target:
splits:
- build: ${exampleAppHostingBuild.name}
percent: 100
exampleAppHostingBuild:
type: gcp:firebase:AppHostingBuild
name: example
properties:
project: ${exampleAppHostingBackend.project}
location: ${exampleAppHostingBackend.location}
backend: ${exampleAppHostingBackend.backendId}
buildId: target-build
source:
container:
image: us-docker.pkg.dev/cloudrun/container/hello
exampleAppHostingBackend:
type: gcp:firebase:AppHostingBackend
name: example
properties:
project: my-project-name
location: asia-east1
backendId: traffic-tg
appId: 1:0000000000:web:674cde32020e16fbce9dbd
servingLocality: GLOBAL_ACCESS
serviceAccount: ${serviceAccount.email}
options:
dependsOn:
- ${fah}
### Include these blocks only once per project if you are starting from scratch ###
serviceAccount:
type: gcp:serviceaccount:Account
name: service_account
properties:
project: my-project-name
accountId: firebase-app-hosting-compute
displayName: Firebase App Hosting compute service account
createIgnoreAlreadyExists: true
appHostingSaRunner:
type: gcp:projects:IAMMember
name: app_hosting_sa_runner
properties:
project: my-project-name
role: roles/firebaseapphosting.computeRunner
member: ${serviceAccount.member}
fah:
type: gcp:projects:Service
properties:
project: my-project-name
service: firebaseapphosting.googleapis.com
The target property defines manual traffic routing. Inside splits, you specify which build receives traffic and what percentage. Setting percent to 100 directs all traffic to that build. This approach gives you full control over deployments, requiring explicit updates to change traffic allocation.
Enable automatic rollouts from a Git branch
Continuous deployment workflows deploy new builds automatically whenever code is pushed to a specified branch.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
//## Include these blocks only once per project if you are starting from scratch ###
const serviceAccount = new gcp.serviceaccount.Account("service_account", {
project: "my-project-name",
accountId: "firebase-app-hosting-compute",
displayName: "Firebase App Hosting compute service account",
createIgnoreAlreadyExists: true,
});
const fah = new gcp.projects.Service("fah", {
project: "my-project-name",
service: "firebaseapphosting.googleapis.com",
});
const exampleAppHostingBackend = new gcp.firebase.AppHostingBackend("example", {
project: "my-project-name",
location: "asia-east1",
backendId: "traffic-rp",
appId: "1:0000000000:web:674cde32020e16fbce9dbd",
servingLocality: "GLOBAL_ACCESS",
serviceAccount: serviceAccount.email,
}, {
dependsOn: [fah],
});
const example = new gcp.firebase.AppHostingTraffic("example", {
project: exampleAppHostingBackend.project,
location: exampleAppHostingBackend.location,
backend: exampleAppHostingBackend.backendId,
rolloutPolicy: {
codebaseBranch: "main",
},
});
const appHostingSaRunner = new gcp.projects.IAMMember("app_hosting_sa_runner", {
project: "my-project-name",
role: "roles/firebaseapphosting.computeRunner",
member: serviceAccount.member,
});
import pulumi
import pulumi_gcp as gcp
### Include these blocks only once per project if you are starting from scratch ###
service_account = gcp.serviceaccount.Account("service_account",
project="my-project-name",
account_id="firebase-app-hosting-compute",
display_name="Firebase App Hosting compute service account",
create_ignore_already_exists=True)
fah = gcp.projects.Service("fah",
project="my-project-name",
service="firebaseapphosting.googleapis.com")
example_app_hosting_backend = gcp.firebase.AppHostingBackend("example",
project="my-project-name",
location="asia-east1",
backend_id="traffic-rp",
app_id="1:0000000000:web:674cde32020e16fbce9dbd",
serving_locality="GLOBAL_ACCESS",
service_account=service_account.email,
opts = pulumi.ResourceOptions(depends_on=[fah]))
example = gcp.firebase.AppHostingTraffic("example",
project=example_app_hosting_backend.project,
location=example_app_hosting_backend.location,
backend=example_app_hosting_backend.backend_id,
rollout_policy={
"codebase_branch": "main",
})
app_hosting_sa_runner = gcp.projects.IAMMember("app_hosting_sa_runner",
project="my-project-name",
role="roles/firebaseapphosting.computeRunner",
member=service_account.member)
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/firebase"
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/projects"
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/serviceaccount"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
// ## Include these blocks only once per project if you are starting from scratch ###
serviceAccount, err := serviceaccount.NewAccount(ctx, "service_account", &serviceaccount.AccountArgs{
Project: pulumi.String("my-project-name"),
AccountId: pulumi.String("firebase-app-hosting-compute"),
DisplayName: pulumi.String("Firebase App Hosting compute service account"),
CreateIgnoreAlreadyExists: pulumi.Bool(true),
})
if err != nil {
return err
}
fah, err := projects.NewService(ctx, "fah", &projects.ServiceArgs{
Project: pulumi.String("my-project-name"),
Service: pulumi.String("firebaseapphosting.googleapis.com"),
})
if err != nil {
return err
}
exampleAppHostingBackend, err := firebase.NewAppHostingBackend(ctx, "example", &firebase.AppHostingBackendArgs{
Project: pulumi.String("my-project-name"),
Location: pulumi.String("asia-east1"),
BackendId: pulumi.String("traffic-rp"),
AppId: pulumi.String("1:0000000000:web:674cde32020e16fbce9dbd"),
ServingLocality: pulumi.String("GLOBAL_ACCESS"),
ServiceAccount: serviceAccount.Email,
}, pulumi.DependsOn([]pulumi.Resource{
fah,
}))
if err != nil {
return err
}
_, err = firebase.NewAppHostingTraffic(ctx, "example", &firebase.AppHostingTrafficArgs{
Project: exampleAppHostingBackend.Project,
Location: exampleAppHostingBackend.Location,
Backend: exampleAppHostingBackend.BackendId,
RolloutPolicy: &firebase.AppHostingTrafficRolloutPolicyArgs{
CodebaseBranch: pulumi.String("main"),
},
})
if err != nil {
return err
}
_, err = projects.NewIAMMember(ctx, "app_hosting_sa_runner", &projects.IAMMemberArgs{
Project: pulumi.String("my-project-name"),
Role: pulumi.String("roles/firebaseapphosting.computeRunner"),
Member: serviceAccount.Member,
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
//## Include these blocks only once per project if you are starting from scratch ###
var serviceAccount = new Gcp.ServiceAccount.Account("service_account", new()
{
Project = "my-project-name",
AccountId = "firebase-app-hosting-compute",
DisplayName = "Firebase App Hosting compute service account",
CreateIgnoreAlreadyExists = true,
});
var fah = new Gcp.Projects.Service("fah", new()
{
Project = "my-project-name",
ServiceName = "firebaseapphosting.googleapis.com",
});
var exampleAppHostingBackend = new Gcp.Firebase.AppHostingBackend("example", new()
{
Project = "my-project-name",
Location = "asia-east1",
BackendId = "traffic-rp",
AppId = "1:0000000000:web:674cde32020e16fbce9dbd",
ServingLocality = "GLOBAL_ACCESS",
ServiceAccount = serviceAccount.Email,
}, new CustomResourceOptions
{
DependsOn =
{
fah,
},
});
var example = new Gcp.Firebase.AppHostingTraffic("example", new()
{
Project = exampleAppHostingBackend.Project,
Location = exampleAppHostingBackend.Location,
Backend = exampleAppHostingBackend.BackendId,
RolloutPolicy = new Gcp.Firebase.Inputs.AppHostingTrafficRolloutPolicyArgs
{
CodebaseBranch = "main",
},
});
var appHostingSaRunner = new Gcp.Projects.IAMMember("app_hosting_sa_runner", new()
{
Project = "my-project-name",
Role = "roles/firebaseapphosting.computeRunner",
Member = serviceAccount.Member,
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.serviceaccount.Account;
import com.pulumi.gcp.serviceaccount.AccountArgs;
import com.pulumi.gcp.projects.Service;
import com.pulumi.gcp.projects.ServiceArgs;
import com.pulumi.gcp.firebase.AppHostingBackend;
import com.pulumi.gcp.firebase.AppHostingBackendArgs;
import com.pulumi.gcp.firebase.AppHostingTraffic;
import com.pulumi.gcp.firebase.AppHostingTrafficArgs;
import com.pulumi.gcp.firebase.inputs.AppHostingTrafficRolloutPolicyArgs;
import com.pulumi.gcp.projects.IAMMember;
import com.pulumi.gcp.projects.IAMMemberArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
//## Include these blocks only once per project if you are starting from scratch ###
var serviceAccount = new Account("serviceAccount", AccountArgs.builder()
.project("my-project-name")
.accountId("firebase-app-hosting-compute")
.displayName("Firebase App Hosting compute service account")
.createIgnoreAlreadyExists(true)
.build());
var fah = new Service("fah", ServiceArgs.builder()
.project("my-project-name")
.service("firebaseapphosting.googleapis.com")
.build());
var exampleAppHostingBackend = new AppHostingBackend("exampleAppHostingBackend", AppHostingBackendArgs.builder()
.project("my-project-name")
.location("asia-east1")
.backendId("traffic-rp")
.appId("1:0000000000:web:674cde32020e16fbce9dbd")
.servingLocality("GLOBAL_ACCESS")
.serviceAccount(serviceAccount.email())
.build(), CustomResourceOptions.builder()
.dependsOn(fah)
.build());
var example = new AppHostingTraffic("example", AppHostingTrafficArgs.builder()
.project(exampleAppHostingBackend.project())
.location(exampleAppHostingBackend.location())
.backend(exampleAppHostingBackend.backendId())
.rolloutPolicy(AppHostingTrafficRolloutPolicyArgs.builder()
.codebaseBranch("main")
.build())
.build());
var appHostingSaRunner = new IAMMember("appHostingSaRunner", IAMMemberArgs.builder()
.project("my-project-name")
.role("roles/firebaseapphosting.computeRunner")
.member(serviceAccount.member())
.build());
}
}
resources:
example:
type: gcp:firebase:AppHostingTraffic
properties:
project: ${exampleAppHostingBackend.project}
location: ${exampleAppHostingBackend.location}
backend: ${exampleAppHostingBackend.backendId}
rolloutPolicy:
codebaseBranch: main
exampleAppHostingBackend:
type: gcp:firebase:AppHostingBackend
name: example
properties:
project: my-project-name
location: asia-east1
backendId: traffic-rp
appId: 1:0000000000:web:674cde32020e16fbce9dbd
servingLocality: GLOBAL_ACCESS
serviceAccount: ${serviceAccount.email}
options:
dependsOn:
- ${fah}
### Include these blocks only once per project if you are starting from scratch ###
serviceAccount:
type: gcp:serviceaccount:Account
name: service_account
properties:
project: my-project-name
accountId: firebase-app-hosting-compute
displayName: Firebase App Hosting compute service account
createIgnoreAlreadyExists: true
appHostingSaRunner:
type: gcp:projects:IAMMember
name: app_hosting_sa_runner
properties:
project: my-project-name
role: roles/firebaseapphosting.computeRunner
member: ${serviceAccount.member}
fah:
type: gcp:projects:Service
properties:
project: my-project-name
service: firebaseapphosting.googleapis.com
The rolloutPolicy property enables automatic deployments. When you set codebaseBranch to “main”, Firebase App Hosting automatically deploys new builds created from that branch. This replaces manual traffic targeting; you cannot use both target and rolloutPolicy simultaneously.
Disable automatic rollouts while preserving branch config
During maintenance or troubleshooting, you may need to pause automatic deployments without removing the rollout policy.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
//## Include these blocks only once per project if you are starting from scratch ###
const serviceAccount = new gcp.serviceaccount.Account("service_account", {
project: "my-project-name",
accountId: "firebase-app-hosting-compute",
displayName: "Firebase App Hosting compute service account",
createIgnoreAlreadyExists: true,
});
const fah = new gcp.projects.Service("fah", {
project: "my-project-name",
service: "firebaseapphosting.googleapis.com",
});
const exampleAppHostingBackend = new gcp.firebase.AppHostingBackend("example", {
project: "my-project-name",
location: "asia-east1",
backendId: "traffic-rpd",
appId: "1:0000000000:web:674cde32020e16fbce9dbd",
servingLocality: "GLOBAL_ACCESS",
serviceAccount: serviceAccount.email,
}, {
dependsOn: [fah],
});
const example = new gcp.firebase.AppHostingTraffic("example", {
project: exampleAppHostingBackend.project,
location: exampleAppHostingBackend.location,
backend: exampleAppHostingBackend.backendId,
rolloutPolicy: {
disabled: true,
codebaseBranch: "main",
},
});
const appHostingSaRunner = new gcp.projects.IAMMember("app_hosting_sa_runner", {
project: "my-project-name",
role: "roles/firebaseapphosting.computeRunner",
member: serviceAccount.member,
});
import pulumi
import pulumi_gcp as gcp
### Include these blocks only once per project if you are starting from scratch ###
service_account = gcp.serviceaccount.Account("service_account",
project="my-project-name",
account_id="firebase-app-hosting-compute",
display_name="Firebase App Hosting compute service account",
create_ignore_already_exists=True)
fah = gcp.projects.Service("fah",
project="my-project-name",
service="firebaseapphosting.googleapis.com")
example_app_hosting_backend = gcp.firebase.AppHostingBackend("example",
project="my-project-name",
location="asia-east1",
backend_id="traffic-rpd",
app_id="1:0000000000:web:674cde32020e16fbce9dbd",
serving_locality="GLOBAL_ACCESS",
service_account=service_account.email,
opts = pulumi.ResourceOptions(depends_on=[fah]))
example = gcp.firebase.AppHostingTraffic("example",
project=example_app_hosting_backend.project,
location=example_app_hosting_backend.location,
backend=example_app_hosting_backend.backend_id,
rollout_policy={
"disabled": True,
"codebase_branch": "main",
})
app_hosting_sa_runner = gcp.projects.IAMMember("app_hosting_sa_runner",
project="my-project-name",
role="roles/firebaseapphosting.computeRunner",
member=service_account.member)
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/firebase"
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/projects"
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/serviceaccount"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
// ## Include these blocks only once per project if you are starting from scratch ###
serviceAccount, err := serviceaccount.NewAccount(ctx, "service_account", &serviceaccount.AccountArgs{
Project: pulumi.String("my-project-name"),
AccountId: pulumi.String("firebase-app-hosting-compute"),
DisplayName: pulumi.String("Firebase App Hosting compute service account"),
CreateIgnoreAlreadyExists: pulumi.Bool(true),
})
if err != nil {
return err
}
fah, err := projects.NewService(ctx, "fah", &projects.ServiceArgs{
Project: pulumi.String("my-project-name"),
Service: pulumi.String("firebaseapphosting.googleapis.com"),
})
if err != nil {
return err
}
exampleAppHostingBackend, err := firebase.NewAppHostingBackend(ctx, "example", &firebase.AppHostingBackendArgs{
Project: pulumi.String("my-project-name"),
Location: pulumi.String("asia-east1"),
BackendId: pulumi.String("traffic-rpd"),
AppId: pulumi.String("1:0000000000:web:674cde32020e16fbce9dbd"),
ServingLocality: pulumi.String("GLOBAL_ACCESS"),
ServiceAccount: serviceAccount.Email,
}, pulumi.DependsOn([]pulumi.Resource{
fah,
}))
if err != nil {
return err
}
_, err = firebase.NewAppHostingTraffic(ctx, "example", &firebase.AppHostingTrafficArgs{
Project: exampleAppHostingBackend.Project,
Location: exampleAppHostingBackend.Location,
Backend: exampleAppHostingBackend.BackendId,
RolloutPolicy: &firebase.AppHostingTrafficRolloutPolicyArgs{
Disabled: pulumi.Bool(true),
CodebaseBranch: pulumi.String("main"),
},
})
if err != nil {
return err
}
_, err = projects.NewIAMMember(ctx, "app_hosting_sa_runner", &projects.IAMMemberArgs{
Project: pulumi.String("my-project-name"),
Role: pulumi.String("roles/firebaseapphosting.computeRunner"),
Member: serviceAccount.Member,
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
//## Include these blocks only once per project if you are starting from scratch ###
var serviceAccount = new Gcp.ServiceAccount.Account("service_account", new()
{
Project = "my-project-name",
AccountId = "firebase-app-hosting-compute",
DisplayName = "Firebase App Hosting compute service account",
CreateIgnoreAlreadyExists = true,
});
var fah = new Gcp.Projects.Service("fah", new()
{
Project = "my-project-name",
ServiceName = "firebaseapphosting.googleapis.com",
});
var exampleAppHostingBackend = new Gcp.Firebase.AppHostingBackend("example", new()
{
Project = "my-project-name",
Location = "asia-east1",
BackendId = "traffic-rpd",
AppId = "1:0000000000:web:674cde32020e16fbce9dbd",
ServingLocality = "GLOBAL_ACCESS",
ServiceAccount = serviceAccount.Email,
}, new CustomResourceOptions
{
DependsOn =
{
fah,
},
});
var example = new Gcp.Firebase.AppHostingTraffic("example", new()
{
Project = exampleAppHostingBackend.Project,
Location = exampleAppHostingBackend.Location,
Backend = exampleAppHostingBackend.BackendId,
RolloutPolicy = new Gcp.Firebase.Inputs.AppHostingTrafficRolloutPolicyArgs
{
Disabled = true,
CodebaseBranch = "main",
},
});
var appHostingSaRunner = new Gcp.Projects.IAMMember("app_hosting_sa_runner", new()
{
Project = "my-project-name",
Role = "roles/firebaseapphosting.computeRunner",
Member = serviceAccount.Member,
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.serviceaccount.Account;
import com.pulumi.gcp.serviceaccount.AccountArgs;
import com.pulumi.gcp.projects.Service;
import com.pulumi.gcp.projects.ServiceArgs;
import com.pulumi.gcp.firebase.AppHostingBackend;
import com.pulumi.gcp.firebase.AppHostingBackendArgs;
import com.pulumi.gcp.firebase.AppHostingTraffic;
import com.pulumi.gcp.firebase.AppHostingTrafficArgs;
import com.pulumi.gcp.firebase.inputs.AppHostingTrafficRolloutPolicyArgs;
import com.pulumi.gcp.projects.IAMMember;
import com.pulumi.gcp.projects.IAMMemberArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
//## Include these blocks only once per project if you are starting from scratch ###
var serviceAccount = new Account("serviceAccount", AccountArgs.builder()
.project("my-project-name")
.accountId("firebase-app-hosting-compute")
.displayName("Firebase App Hosting compute service account")
.createIgnoreAlreadyExists(true)
.build());
var fah = new Service("fah", ServiceArgs.builder()
.project("my-project-name")
.service("firebaseapphosting.googleapis.com")
.build());
var exampleAppHostingBackend = new AppHostingBackend("exampleAppHostingBackend", AppHostingBackendArgs.builder()
.project("my-project-name")
.location("asia-east1")
.backendId("traffic-rpd")
.appId("1:0000000000:web:674cde32020e16fbce9dbd")
.servingLocality("GLOBAL_ACCESS")
.serviceAccount(serviceAccount.email())
.build(), CustomResourceOptions.builder()
.dependsOn(fah)
.build());
var example = new AppHostingTraffic("example", AppHostingTrafficArgs.builder()
.project(exampleAppHostingBackend.project())
.location(exampleAppHostingBackend.location())
.backend(exampleAppHostingBackend.backendId())
.rolloutPolicy(AppHostingTrafficRolloutPolicyArgs.builder()
.disabled(true)
.codebaseBranch("main")
.build())
.build());
var appHostingSaRunner = new IAMMember("appHostingSaRunner", IAMMemberArgs.builder()
.project("my-project-name")
.role("roles/firebaseapphosting.computeRunner")
.member(serviceAccount.member())
.build());
}
}
resources:
example:
type: gcp:firebase:AppHostingTraffic
properties:
project: ${exampleAppHostingBackend.project}
location: ${exampleAppHostingBackend.location}
backend: ${exampleAppHostingBackend.backendId}
rolloutPolicy:
disabled: true
codebaseBranch: main
exampleAppHostingBackend:
type: gcp:firebase:AppHostingBackend
name: example
properties:
project: my-project-name
location: asia-east1
backendId: traffic-rpd
appId: 1:0000000000:web:674cde32020e16fbce9dbd
servingLocality: GLOBAL_ACCESS
serviceAccount: ${serviceAccount.email}
options:
dependsOn:
- ${fah}
### Include these blocks only once per project if you are starting from scratch ###
serviceAccount:
type: gcp:serviceaccount:Account
name: service_account
properties:
project: my-project-name
accountId: firebase-app-hosting-compute
displayName: Firebase App Hosting compute service account
createIgnoreAlreadyExists: true
appHostingSaRunner:
type: gcp:projects:IAMMember
name: app_hosting_sa_runner
properties:
project: my-project-name
role: roles/firebaseapphosting.computeRunner
member: ${serviceAccount.member}
fah:
type: gcp:projects:Service
properties:
project: my-project-name
service: firebaseapphosting.googleapis.com
Setting disabled to true within rolloutPolicy pauses automatic deployments while keeping the codebaseBranch configuration intact. This extends the automatic rollout example by adding pause capability. When you set disabled back to false, automatic deployments resume from the configured branch.
Beyond these examples
These snippets focus on specific traffic configuration features: manual traffic routing to specific builds and automatic rollouts from Git branches. They’re intentionally minimal rather than full deployment pipelines.
The examples reference pre-existing infrastructure such as Firebase App Hosting backends, Firebase App Hosting builds, service accounts with the firebaseapphosting.computeRunner role, and Git repositories connected to Firebase App Hosting for rollout policies. They focus on traffic routing configuration rather than provisioning the underlying infrastructure.
To keep things focused, common traffic patterns are omitted, including:
- Traffic splitting across multiple builds (multiple splits entries)
- Gradual rollout percentages (canary deployments)
- Rollout policy stage configuration
- Custom rollout timing and triggers
These omissions are intentional: the goal is to illustrate how traffic routing is wired, not provide drop-in deployment modules. See the Firebase App Hosting Traffic resource reference for all available configuration options.
Let's configure GCP Firebase App Hosting Traffic
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Traffic Control & Configuration
What's the difference between target and rolloutPolicy?
You can control traffic in two ways: use
target with splits for manual control over specific builds and percentages, or use rolloutPolicy with codebaseBranch for automatic rollouts triggered by code changes.How do I manually control traffic distribution across builds?
Configure
target.splits with an array specifying the build name and percentage for each split. The percentages must add up to 100.Can I disable automatic rollouts?
Yes, set
rolloutPolicy.disabled to true while keeping the codebaseBranch configured.Resource Configuration & Immutability
Can I change the backend, location, or project after creation?
No, these properties are immutable and cannot be modified after the resource is created. Changing them requires recreating the resource.
IAM & Permissions
What IAM role does the service account need?
The service account requires the
roles/firebaseapphosting.computeRunner role to run the backend.Traffic State & Synchronization
Why doesn't my traffic allocation match what I configured?
The
currents field shows the actual traffic state, which may differ from your target configuration for some time until the desired state is reached.Using a different cloud?
Explore integration guides for other cloud providers: