roles/recommender.firestoredatabasefirebaserulesViewer permissões, mais recommender.firestoreDatabaseFirebaseRulesRecommendations.update recommender.firestoreDatabaseFirebaseRulesInsights.update
Para mais informações sobre papéis e como conceder acesso, consulte:
Você só pode ver as recomendações de regras de segurança do Firestore se tiver bancos de dados não vazios e em uso com regras expostas a acesso amplo configuradas. O projeto precisa ter pelo menos 30 dias para que as recomendações sejam geradas.
É possível conferir recomendações/insights das regras de segurança do Firestore de várias maneiras:
Ver recomendações
Google Cloud console
Para ver suas recomendações, faça o seguinte:
Acesse o console Google Cloud ou use o seguinte botão:
As recomendações podem ser acessadas na página do Hub de recomendações ou da Central de banco de dados.
Pesquise Recomendações para acessar a página do Hub de recomendações.
Você pode selecionar e conferir uma categoria específica de recomendações.
Pesquise Database Center.
Você pode aplicar um filtro de produto e ver os problemas específicos da frota.
CLI da gcloud
Para listar as recomendações de regras de segurança do Firestore usando gcloud, execute o comando
gcloud recommender recommendations list
da seguinte forma:
As recomendações e os insights das regras de segurança do Firestore estão disponíveis sem custo financeiro. Para informações sobre outros níveis de preço, consulte
Preços de recomendações.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-04 UTC."],[],[],null,["# Firestore Security Rules recommender\n====================================\n\nThe Firestore Security Rules recommender supports the following recommendation subtype:\n\n- [Update Insecure Policy](/firestore/docs/security/insecure-rules)\n\nwhich are security concerns for Firestore customers providing users\nextra access than the users intend.\n\nThis document describes how to enable and view your recommendations\nand insights to improve the security of your databases.\n\nBefore you begin\n----------------\n\nBefore you can view Firestore Firestore Security rules\nrecommendations and insights, do the following:\n\n1. Enable the Recommender API as described in\n [Enable the API](/recommender/docs/enabling).\n\n2. Ensure that you have sufficient permissions.\n You must have one of the following roles, which provide the necessary\n permissions:\n\n\n \u003cbr /\u003e\n\n These Recommender roles provide the following API permissions:\n\n\n \u003cbr /\u003e\n\n For more information about roles and about granting access, see the\n following:\n - [Understanding roles](/iam/docs/understanding-roles)\n - [Managing access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access)\n\nYou can view Firestore Security rules recommendations only if you have non-empty, in-use databases that have any rules exposed to broad access configured. The project\nmust be at least 30 days old for recommendations to be generated for it.\n\nYou can view Firestore Security rules recommendations/insights in different ways:\n\nView recommendations\n--------------------\n\n### Google Cloud console\n\n\nYou can view your recommendations by doing following:\n\nGo to the Google Cloud console, or use the following button:\n\n[Go to Google Cloud console](https://console.cloud.google.com/)\n\nRecommendations can be viewed on **Recommendation Hub** or **Database Center** page.\n\n1. Search for **Recommendations** which will lead to the Recommendation Hub page.\n You can select specific category of recommendation and view them.\n\n2. Search for **Database Center**.\n You can apply product filter and view the specific fleet issues.\n\n\u003cbr /\u003e\n\n### gcloud CLI\n\n\nTo list Firestore Security rules recommendations by using `gcloud`, run the\n[`gcloud recommender recommendations list`](/sdk/gcloud/reference/recommender/recommendations/list)\ncommand as follows: \n\n gcloud recommender recommendations list \\\n --project=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003ePROJECT_ID\u003c/span\u003e\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eLOCATION\u003c/span\u003e\u003c/var\u003e \\\n --recommender=google.firestore.database.\u003cvar\u003eRECOMMENDER\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your project ID\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: A region, such as `us-central1`\n- \u003cvar translate=\"no\"\u003eRECOMMENDER\u003c/var\u003e: The ID of the recommender as `FirebaseRulesRecommender`.\n\n\u003cbr /\u003e\n\n### Recommender API\n\n\nTo list your Firestore Security rules recommendations by using the\n[Recommendations API](/recommender/docs/using-api), call the\n[`recommendations.list`](/recommender/docs/reference/rest/v1beta1/projects.locations.recommenders.recommendations/list)\nmethod as follows: \n\n curl -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"x-goog-user-project: \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\" \\\n \"https://recommender.googleapis.com/v1/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/recommenders/google.firestore.database.\u003cvar translate=\"no\"\u003eRECOMMENDER\u003c/var\u003e/recommendations\"\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your project ID.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: A region, such as `us-central1`.\n- \u003cvar translate=\"no\"\u003eRECOMMENDER\u003c/var\u003e: The ID of the recommender as `FirebaseRulesRecommender`.\n\nFor more information, see [Using the API - Recommendations](/recommender/docs/using-api).\n\nView insights\n-------------\n\nYou can view insights and detailed recommendations about Firestore Security\nrules in different ways. \n\n### gcloud CLI\n\n\nTo view insights by using `gcloud`, run the\n[`gcloud recommender insights list`](/sdk/gcloud/reference/recommender/insights/list)\ncommand as follows: \n\n gcloud recommender insights list \\\n --project=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-nx\"\u003ePROJECT_ID\u003c/span\u003e\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-nx\"\u003eLOCATION\u003c/span\u003e\u003c/var\u003e \\\n --insight-type=google.firestore.database.\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-nx\"\u003eINSIGHT_TYPE\u003c/span\u003e\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your project ID.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: A region, such as `us-central1`.\n- \u003cvar translate=\"no\"\u003eINSIGHT_TYPE\u003c/var\u003e: The ID of the insight type as `FirebaseRulesInsight`.\n\n \u003cbr /\u003e\n\n### Recommender API\n\n\nTo list your insights by using the\nRecommender API, run the following command: \n\n curl -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n\n \"https://recommender.googleapis.com/v1/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/insightTypes/google.firestore.database.\u003cvar translate=\"no\"\u003eINSIGHT_TYPE\u003c/var\u003e/insights\"\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your project ID.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: A region, such as `us-central1`.\n- \u003cvar translate=\"no\"\u003eINSIGHT_TYPE\u003c/var\u003e: The ID of the insight type as `FirebaseRulesInsight`.\n\nFor more information, see [Using the API - Insights](/recommender/docs/insights/using-api).\n\n\u003cbr /\u003e\n\nApply recommendations\n---------------------\n\nFor more information about how to improve your database security, see\n[Structure security rules](/firestore/docs/security/rules-structure).\n\nPricing\n-------\n\nFirestore Security rules recommendations and insights are\navailable free of charge. For information about other pricing tiers, see\n[Recommender pricing](/recommender/pricing)."]]
