> Documentation index: https://firebase.google.com/docs/llms.txt

> [!WARNING]
> **Preview:** This is a preview release of Firebase support for the Application Design Center. This set of features and tools might be changed in backward-incompatible ways and is not subject to any SLA or deprecation policy.

Firebase integrates with the
[Application Design Center (ADC)](https://docs.cloud.google.com/application-design-center/docs/overview)
from Google Cloud to let enterprise customers meet standardization and
governance needs while also empowering their app developers to ship with
velocity. Using ADC ensures that
infrastructure adheres to organizational standards and best practices through
predefined ***templates*** which define guardrails for provisioning resources,
granting IAM permissions, etc.

On this page, learn about the following:

- [Overview of ADC and Firebase](https://firebase.google.com/docs/projects/adc/get-started.md.txt#overview), including [supported Firebase products](https://firebase.google.com/docs/projects/adc/get-started.md.txt#supported-firebase-products)
- [Key personas](https://firebase.google.com/docs/projects/adc/get-started.md.txt#key-personas) and the [required IAM roles to control access](https://firebase.google.com/docs/projects/adc/get-started.md.txt#iam-roles-and-permissions)
- [General workflow](https://firebase.google.com/docs/projects/adc/get-started.md.txt#general-workflow)

## Overview of ADC and Firebase

We recommend reviewing the Google Cloud documentation for an
[overview of ADC](https://docs.cloud.google.com/application-design-center/docs/overview).
The Google Cloud documentation also provides several in-depth guides for
ADC, including
[key concepts](https://docs.cloud.google.com/application-design-center/docs/key-concepts)
and an
[initial setup guide](https://docs.cloud.google.com/application-design-center/docs/setup).

When using ADC, an "app" is defined as a
logical grouping of resources and services that together deliver a business
function. **For Firebase developers, you can think of an
ADC "app" as equivalent to a
Firebase project**, where your registered iOS, Android, and web apps all share
and have access to all the same resources and services for the project.

For getting started, we recommend working with
ADC using their GUI experience called the
[*design canvas*](https://docs.cloud.google.com/application-design-center/docs/design-application-templates#design_your_template)
that's available in the Google Cloud console. The design canvas lets you
visualize and create architecture diagrams of the infrastructure you want
available to your apps.

Note that ADC is backed by Terraform, so
you'll always have access to the code definition of infrastructure that's
defined using ADC.

### Supported Firebase products

Here is the initial set of supported Firebase products that can be used with
ADC:

- [Firebase AI Logic](https://firebase.google.com/docs/ai-logic.md.txt)
- [Firebase Authentication](https://firebase.google.com/docs/auth.md.txt)
- [Firebase App Check](https://firebase.google.com/docs/app-check.md.txt)
- [Cloud Firestore](https://firebase.google.com/docs/firestore.md.txt)
- [Firebase Security Rules](https://firebase.google.com/docs/rules.md.txt)

## Key personas for using ADC

A common way to understand and use ADC is to
break down ADC-related tasks based on two
personas:

- ***Platform Engineer*** : This persona designs, verifies, and publishes
  reusable, policy-enforced ADC templates to
  an ADC catalog.

- ***Application Developer*** : This persona uses published
  ADC templates (like from the team's
  ADC catalog) to configure and deploy
  infrastructure. They also develop the app's actual codebase and features.

> [!NOTE]
> **Note:** To use ADC, the same person can take on both personas and perform all ADC-related tasks end-to-end. However, this guide assumes that if you're using ADC, then you're likely a customer who wants only certain people on your team performing certain tasks and making decisions about which infrastructure can be used and how it can be configured (meaning the Platform Engineer persona).

### Required IAM roles to control access

By assigning IAM roles, you can control which project members (or *principals*)
can perform specific tasks.

For example, you might assign the *Application Design Center Admin* role
(`roles/designcenter.admin`) to the Platform Engineer who needs to create and
assign spaces, manage catalogs, and design templates. However, you'd likely only
assign the *Application Editor* role (`roles/designcenter.applicationEditor`) to
an Application Developer so that they can *use* templates, but not *create*
templates.

> [!IMPORTANT]
> **Important:** In addition to the ADC-specific tasks and roles described in this subsection, you need to make sure that project members also have the appropriate access to work with Firebase products and Firebase interfaces. For more details, review the [Firebase IAM documentation](https://firebase.google.com/docs/projects/iam/overview.md.txt).

The following table describes ADC-related
tasks, their intended persona, and their required roles:

| Task | Persona | IAM role ^**1**^ |
|---|---|---|
| **Create and manage templates** |||
| Manage the full ADC lifecycle (including managing spaces, catalogs, templates, configuring and deploying apps) | Platform Engineer | [Application Design Center Admin](https://docs.cloud.google.com/application-design-center/docs/access-control#role-descriptions) (`roles/designcenter.admin`) on the *management project* |
| Create and manage templates as well as configure and deploy apps | Platform Engineer | [Application Design Center User](https://docs.cloud.google.com/application-design-center/docs/access-control#role-descriptions) (`roles/designcenter.user`) on the *management project* |
| **Create a service account for deploying ADC apps** |||
| Create service accounts | Platform Engineer | [Create Service Accounts](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.serviceAccountCreator) (`roles/iam.serviceAccountCreator`) on the *management project* |
| Grant a service account access to a *project used for ADC deployment* | Platform Engineer | [Project IAM Admin](https://docs.cloud.google.com/resource-manager/docs/access-control-proj#resourcemanager.projectIamAdmin) (`roles/resourcemanager.projectIamAdmin`) on the *deployment project* |
| **Configure and deploy ADC apps** |||
| Control the full app lifecycle (including integration with source code and CI/CD systems) | Application Developer | [Application Admin](https://docs.cloud.google.com/application-design-center/docs/access-control#role-descriptions) (`roles/designcenter.applicationAdmin`) on the *management project* |
| Configure and deploy apps based on existing templates and connections set up by an Admin | Application Developer | [Application Editor](https://docs.cloud.google.com/application-design-center/docs/access-control#role-descriptions) (`roles/designcenter.applicationEditor`) on the *management project* |

^**1** *Several of these roles need to be set on the
[***management project***](https://docs.cloud.google.com/application-design-center/docs/key-concepts#mgmt-project),
which is a top-level resource within the Google Cloud hierarchy.*^

## General workflow

This section describes a general workflow for creating and using an
ADC template. The steps are tagged with the
persona who would usually perform the step.

1. [Step 1: Set up ADC (Platform Engineer)](https://firebase.google.com/docs/projects/adc/get-started.md.txt#set-up-adc)
2. [Step 2: Create a template (Platform Engineer)](https://firebase.google.com/docs/projects/adc/get-started.md.txt#create-a-template)
3. [Step 3: Use a template (Application Developer)](https://firebase.google.com/docs/projects/adc/get-started.md.txt#use-template)
4. [Step 4: Develop your actual app (Application Developer)](https://firebase.google.com/docs/projects/adc/get-started.md.txt#develop-app)

> [!NOTE]
> **Note:** To use ADC, the same person can take on both personas and perform all ADC-related tasks end-to-end. However, this guide assumes that if you're using ADC, then you're likely a customer who wants only certain people on your team performing certain tasks and making decisions about which infrastructure can be used and how it can be configured (meaning the Platform Engineer persona).

### **Step 1** : Set up ADC (Platform Engineer)

The Platform Engineer persona (or higher) completes these tasks to set up
ADC. These tasks usually only need to be
completed once to have everything set up to use
ADC.

1. **Initial ADC setup.**

   Follow the steps and guidance in the
   [initial setup guide](https://docs.cloud.google.com/application-design-center/docs/setup)
   for ADC in the Google Cloud documentation.
   Note that this guide assumes that you'll set up
   ***folder-level boundaries***.

   After you complete this setup, you should have a ***space*** , which is a
   dedicated area for a team to collaborate, create templates, and deploy
   applications. Make sure this space (and the folder and catalog) is shared
   with everyone you want to work with ADC.
2. **Set up access and users for the space.**

   Follow the steps in
   [Manage space users](https://docs.cloud.google.com/application-design-center/docs/manage-spaces#manage_space_users)
   for ADC in the Google Cloud documentation.
   Use the guidance described earlier on this page about
   [Required IAM roles to control access](https://firebase.google.com/docs/projects/adc/get-started.md.txt#iam-roles-and-permissions).
3. **Pre-provision projects.**

   Create one or more new Google Cloud projects in the folder. Make sure that
   you link a Cloud Billing account to these projects. These projects will
   be used by your Application Developer when they deploy the infrastructure
   defined in the template.
4. **Configure a deployment service account.**

   ADC manages the automated provisioning of
   resources using a tightly scoped service account. This prevents the
   Application Developer from using their own account to deploy infrastructure.

   ADC can automatically create a tightly
   scoped service account on your behalf as you test the deployment of the
   templates you create. You also have the option to bring your own service
   account that has the permissions you deem to be appropriate for
   Application Developers.

### **Step 2**: Create a template (Platform Engineer)

The Platform Engineer persona uses the
[*design canvas*](https://docs.cloud.google.com/application-design-center/docs/design-application-templates#design_your_template)
or even Gemini Cloud Assist to create a new
ADC template.

1. **Define resources.**

   Using the design canvas, drag-and-drop components onto the canvas and create
   connections between them. These components are how you define which Firebase
   (and Google Cloud) services you want Application Developers to use.

   For example, the template could define resources like the following:
   - Application Developers can develop iOS, Android, and web apps that all use the resources.
   - Application Developers can use Firebase AI Logic, Firebase Authentication, Cloud Firestore, and Firebase Security Rules in their app (see a [list of all supported Firebase products for ADC](https://firebase.google.com/docs/projects/adc/get-started.md.txt#supported-firebase-products)).
   - Firebase Security Rules are initially set to deny all access requests by default. Then, when the Application Developer uses this template for their own deployment, they'll be able to change these Security Rules to align with their required access model.
2. **Define policies.**

   If you want to define policies, such as IAM roles for the deployed
   infrastructure or allowed regions for resources, then you need to set those
   in the respective interfaces for those policies.
   ADC does not currently support defining
   policies at the template-level.

   You can assign specific [Firebase IAM](https://firebase.google.com/docs/projects/iam/overview.md.txt) roles to
   project members depending on what you want them to do. For example, if they
   only need to view resources in the Firebase console, then assign them the
   *Firebase Viewer* role (`roles/firebase.viewer`).

   You can set region limitations for resources at the folder or org level.
3. **Add the template to a catalog.**

   After you've tested your template, add it to your team's
   ADC catalog. This catalog must be shared
   with the appropriate people, in particular the Application Developers so
   that they can use the templates (see
   [Step 1: Set up ADC](https://firebase.google.com/docs/projects/adc/get-started.md.txt#set-up-adc) above).

### **Step 3**: Use a template (Application Developer)

The Application Developer persona selects a predefined template, configures it
for their specific use case, and then deploys the infrastructure.

1. **Select a template and configure it.**

   From the ADC catalog, select a template
   and configure it to create an *application draft*. The available
   configurations --- like possible regions for resources --- are limited to those
   set by the Platform Engineer when they created the template.
2. **Deploy the infrastructure.**

   After the application draft is created, deploy the
   ADC app to one of the pre-provisioned
   projects created for infrastructure deployment (see
   [Step 1: Set up ADC](https://firebase.google.com/docs/projects/adc/get-started.md.txt#set-up-adc) above)

   You can visit the
   [Firebase console](https://console.firebase.google.com/project/_/?useAutoProject=true)
   and view the provisioned resources and enabled services for your project.

   > [!NOTE]
   > **Note:** Currently, you can't see ADC-deployed Firebase projects in lists of projects within the Firebase console or the Firebase CLI. However, if you have a project's *project ID* , then you can directly open an ADC-deployed Firebase project using its Firebase console URL: `https://console.firebase.google.com/project/PROJECT_ID/overview`

### **Step 4**: Develop your actual app (Application Developer)

ADC helps to set up Firebase and Google Cloud
***infrastructure*** (like provisioning resources and enabling APIs). However,
it does ***not*** do the coding of the actual app that uses those resources and
APIs.

Here are some important things that the Application Developer persona needs to
do:

1. **Connect your app's codebase to Firebase.**

   [Obtain and then add the Firebase configuration](https://support.google.com/firebase/answer/7015592)
   to each app's codebase.

   For example, if the template allows an Android app, then you must add the
   `google-services.json` file to the appropriate directory within your
   Android project.
2. **Keep code and resources aligned.**

   *(if using Cloud Firestore)* Make sure to update and publish Firebase Security Rules to
   align with the Cloud Firestore data model for the app.

## What else can you do?

- [Monitor deployed ADC "apps"](https://docs.cloud.google.com/application-design-center/docs/monitor-applications), which are automatically registered in App Hub. This enables consolidated monitoring, cost observation, and troubleshooting for the Firebase resources within the context of broader Google Cloud deployments.