Create and manage databases (original) (raw)

This page describes how to create, update, and delete Firestore databases. You can create multiple Firestore databases per project. You can use multiple databases to set up production and testing environments, to isolate customer data, and for data regionalization.

Required roles and permissions

To create and manage databases, you'll need the following Identity and Access Management role:

That role grants the following permissions that you need to create and manage databases:

Create a database

To create a database, use one of the following methods:

Console
  1. In the Google Cloud console, go to the Databases page.
    Go to Databases
  2. Click Create a Firestore database.
  3. Enter a database ID.
  4. Select a Firestore edition. See theeditions overviewto learn more about each edition.
  5. Select a data access mode. The data access mode configures which API and which client libraries you can use with your database.
  6. If you select Firestore in Native mode:
    • Configure your initial security rules. Select Restrictive if you don't plan to use the Firebase mobile and web SDKs.
    • If you selected Enterprise edition, enable or disable real-time updates for your database.
  7. Select a location.
  8. (Optional) If you need Customer-managed encryption keys (CMEK), expand and configure the encryption options.
  9. Click Create Database.
gcloud

Use thegcloud firestore databases createcommand.

--delete-protection is an optional flag to enable deletion protection. You cannot delete a database with deletion protection enabled until you disable this setting. This setting is disabled by default.

To add tagsto the database, use the--tagsflag. For example:

Firebase CLI

firebase firestore:databases:create DATABASE_ID \n--location=LOCATION \n[--edition EDITION] \n[--firestore-data-access FIRESTORE_ACCESS] \n[--realtime-updates REALTIME_UPDATES] \n[--delete-protection DELETE_PROTECTION_ENABLEMENT]

Replace the following:

Terraform

resource "google_firestore_database" "database" { project = "project-id" name = DATABASE_ID location_id = LOCATION type = DATABASE_TYPE

// Optional delete_protection_state = DELETE_PROTECTION_STATE }

Replace the following:

delete_protection_state is an optional argument to enable deletion protection. You cannot delete a database with deletion protection enabled until you disable this setting. This setting is disabled by default.

Database ID

A valid database Id must conform to these rules:

There is one exception to these rules: Standard edition will create a database named (default) if you don't enter an ID yourself.

Note that after you delete a database, you can't re-use its ID for about 5 minutes.

Delete protection

Use delete protection to prevent accidental deletion of a database. You cannot delete a database with delete protection enabled until you disable delete protection. Delete protection is disabled by default. You can update the database configuration to enable or disable delete protection.

Set up Firestore Security Rules for your databases

Use the Firebase CLI to deploy Firestore Security Rules to each of your databases. Refer to the guide for managing and deploying Firestore Security Rules.

Access a named database with a client library

A named database includes any database not named (default). By default, the Firebase SDKs and Google API Client Libraries connect to the (default)Firestore database in a project. To create a client connected to a named database, set the database ID when you instantiate a client.

List databases

Use one of the following methods to list your databases:

Console

In the Google Cloud console, go to the Databases page.

Go to Databases

gcloud

Use thegcloud firestore databases listcommand to list all the databases in your project.

gcloud firestore databases list

Firebase CLI

Use the firebase firestore:databases:list command to list all the databases in your project.

firebase firestore:databases:list

View database details

To view details about a single database, use one of the following methods:

gcloud

Use the gcloud firestore databases describe command:

gcloud firestore databases describe --database=DATABASE_ID

Firebase CLI

Use the firebase firestore:databases:get command:

firebase firestore:databases:get DATABASE_ID

The output for an Enterprise database includes the following fields:

Replace DATABASE_ID with a database ID.

Update database configuration

To update the configurations settings of a database, use the gcloud firestore databases updatecommand. Use this command to change the database type or to toggle delete protection.

Change the database type

To update the type of a database, use the gcloud firestore databases updatecommand with the --type= flag. You can change the type only if the database is empty.

gcloud

gcloud firestore databases update --database=DATABASE_ID
--type=DATABASE_TYPE

Replace the following:

Update the delete protection setting

To enable delete protection on a database, use the gcloud firestore databases update command with the --delete-protection flag. For example:

gcloud

gcloud firestore databases update --database=DATABASE_ID --delete-protection

Replace DATABASE_ID with a database ID.

To disable delete protection on a database, use the gcloud firestore databases update command with the --no-delete-protection flag. For example:

gcloud

gcloud firestore databases update --database=DATABASE_ID --no-delete-protection

Replace DATABASE_ID with a database ID.

Delete a database

To delete a database, use the console or command-line tool.

If the database has the delete protection setting enabled, you must firstdisable delete protection.

If the database contains App Engine search data orblob entities, you must delete that data first.

Deleting a database does not automatically delete any Eventarc triggers for that database. The trigger stops delivering events but continues to exist until you delete the trigger.

Deleting a database does not incur charges for delete operations.

Console
  1. In the Google Cloud console, go to the Databases page.
    Go to Databases
  2. Click View more in the table row for the database you want to delete. Click Delete. A dialog appears.
  3. In the Delete database? dialog, confirm deletion by typing the database ID in the text field. Click Delete. The console informs you of operation success or failure.
    If the operation fails,view the database details and verify that delete protection is disabled. To disable delete protection, seeUpdate the delete protection setting.
gcloud

Use the`gcloud firestore databases delete` command.

gcloud firestore databases delete --database=DATABASE_ID

Replace DATABASE_ID with the ID of the database to delete. To delete the default database use the ID '(default)'

Clone a database

You can clone an existing database at a selected timestamp into a new database:

Console

  1. In the Google Cloud console, go to the Databases page.

Go to Databases

  1. Click View more in the table row for the database that you want to clone. Click Clone. TheCreate a clone dialog appears.
  2. In the Create a clone dialog, provide parameters for cloning the database:
    1. In the Give the clone an ID field, a database IDfor a new cloned database. This database ID must not be associated with an existing database.
    2. In the Clone from field, select a point in time to use for cloning. The selected time corresponds to a PITR timestamp, at the minute granularity.
  3. Click Create clone.

gcloud

Use the gcloud firestore databases clonecommand to clone a database:

gcloud firestore databases clone \
--source-database='SOURCE_DATABASE' \
--snapshot-time='PITR_TIMESTAMP' \
--destination-database='DESTINATION_DATABASE_ID'

Replace the following:

Example:

gcloud firestore databases clone \
--source-database='projects/example-project/databases/(default)' \
--snapshot-time='2025-06-01T10:20:00.00Z' \
--destination-database='example-dest-db'

If you want to bind to some tags while cloning a database, use the previous command with the --tags flag, which is an optional list of tags KEY=VALUE pairs to bind.

Example:

gcloud firestore databases clone \
--source-database='projects/example-project/databases/(default)' \
--snapshot-time='2025-06-01T10:20:00.00Z' \
--destination-database='example-dest-db'

By default, the cloned database will have the same encryption configuration as the source database. To change the encryption configuration, use the--encryption-type argument:

The following example shows how to configure CMEK encryption for the cloned database:

gcloud firestore databases clone \
--source-database='projects/example-project/databases/(default)' \
--snapshot-time='2025-06-01T10:20:00.00Z' \
--destination-database='example-dest-db' \
--encryption-type='customer-managed-encryption' \
--kms-key-name='projects/example-project/locations/us-central1/keyRings/example-key-ring/cryptoKeys/example-key'

Configure per-database access permissions

You can use Identity and Access Management Conditions to configure access permissions on a per-database level. The following examples use the Google Cloud CLI to assign conditional access for one or more databases. You can also define IAM conditions in the Google Cloud console.

View existing IAM policies

gcloud projects get-iam-policy PROJECT_ID

Set PROJECT_ID to your project ID.

Grant access to a database

gcloud projects add-iam-policy-binding PROJECT_ID \
--member='user:EMAIL' \
--role='roles/datastore.user' \
--condition='expression=resource.name=="projects/PROJECT_ID/databases/DATABASE_ID",title=TITLE,description=DESCRIPTION'

Set the following:

Grant access to all except one database

gcloud projects add-iam-policy-binding PROJECT_ID \
--member='user:EMAIL' \
--role='roles/datastore.user' \
--condition='expression=resource.name!="projects/PROJECT_ID/databases/DATABASE_ID",title=TITLE,description=DESCRIPTION'

Set the following:

Remove policies for a given member and role

gcloud projects remove-iam-policy-binding PROJECT_ID \
--member='user:EMAIL' \
--role='roles/datastore.user' --all

Set the following:

Cloud Monitoring

Firestore metrics are reported under two monitored resources.

You can inspect aggregate metrics at the database level by looking atfirestore.googleapis.com/Database. The metrics reported underfirestore_instance are aggregated at the project level.

Limitations

What's next