How to set up a scalable and secure application in GCP using CloudRun, API Gateway, and Firebase

provider "google" {
  project = "< project_id>"
  region  = "europe-west1"
}

provider "google-beta" {
  project = "< project_id> "
  region  = "europe-west1"
}

resource "google_service_account" "service_account_apigw" {
  account_id   = "apigw-sa"
  display_name = "API GW Service Account"
}

resource "google_cloud_run_service" "hello" {
  name     = "hello"
  location = "europe-west1"

  template {
    spec {
      containers {
        image = "gcr.io/cloudrun/hello"

      }
    }
  }
}

output "cloudrun_endpoint" {
  value = google_cloud_run_service.hello.status[0].url
}

# Only allow the API Gateway service account to call your Cloud Run instance
resource "google_cloud_run_service_iam_member" "public_access" {
  provider = google
  service  = google_cloud_run_service.hello.name
  location = google_cloud_run_service.hello.location
  project  = google_cloud_run_service.hello.project
  role     = "roles/run.invoker"
  member   = "serviceAccount:${google_service_account.service_account_apigw.email}"
}

swagger: '2.0'
info:
  title: Example Gateway
  description: API Gateway with firebase auth
  version: 1.0.0
schemes:
  - https
produces:
  - application/json
securityDefinitions:
  firebase:
    authorizationUrl: ''
    flow: implicit
    type: oauth2
    x-google-issuer: "<firebase_admin_serviceaccount_email>"
    x-google-jwks_uri: "https://www.googleapis.com/service_accounts/v1/metadata/x509/<firebase_admin_serviceaccount_email>"
    x-google-audiences: "https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit"
paths:
  /v1/hello:
    get:
      security:
        - firebase: []
      description: Hello
      operationId: hello
      responses:
        '200':
          description: Success
      x-google-backend:
        address: '<cloudrun_url>'

resource "google_api_gateway_api" "api" {
  provider = google-beta
  api_id   = "my-api"
}

resource "google_api_gateway_api_config" "api_cfg" {
  provider      = google-beta
  api           = google_api_gateway_api.api.api_id
  api_config_id = "config1"

  openapi_documents {
    document {
      path     = "spec.yaml"
      contents = filebase64("./swagger.yaml")
    }
  }

  lifecycle {
    create_before_destroy = false
  }

  gateway_config {
    backend_config {
      google_service_account = google_service_account.service_account_apigw.name
    }
  }
}

resource "google_api_gateway_gateway" "api_gw" {
  provider   = google-beta
  api_config = google_api_gateway_api_config.api_cfg.id
  gateway_id = "api-gw"
  lifecycle {
    ignore_changes = [
      api_config
    ]
  }
}

output "apigw_endpoint" {
  value = google_api_gateway_gateway.api_gw.default_hostname
}

import os
import pyrebase
import firebase_admin
from firebase_admin import auth

# ===== ADMIN APP FOR MANAGING USER ===== #

# App initialization
firebase_admin_app = firebase_admin.initialize_app()

# Signup => using firebase_admin
def signup():
    print("Sign up...")
    email = input("Enter email: ")
    password=input("Enter password: ")
    try:
        # More properties for user creation can be found on SDK Admin doc
        user = auth.create_user(email=email, password=password)

        # Create a custom token using userID after creation
        additional_claims = {'profile': "a-user-profile"}
        custom_token = auth.create_custom_token(user.uid, additional_claims)
    except Exception as e: 
        print(e)
    return


# ===== FIREBASE APP FOR LOGIN USER ===== #

config = {
    'apiKey': "<apiKey>",
    'authDomain': "<project-id>.firebaseapp.com",
    'projectId': "<project-id>",
    'storageBucket': "<project-id>.appspot.com",
    'messagingSenderId': "<messagingSenderId'>",
    'appId': "<appId>",
    'databaseURL': ""}

firebase_app = pyrebase.initialize_app(config)
authentication = firebase_app.auth()

# Login => using firebase (not admin)
def login():
    print("Log in...")
    email=input("Enter email: ")
    password=input("Enter password: ")
    try:
        user = authentication.sign_in_with_email_and_password(email, password)
        print("User authenticated")
        print("User ID :")
        print(user['localId'])

        # Create a custom token using userID after authentication (localId = uid)
        additional_claims = {'profile': "a-user-profile"}
        custom_token = auth.create_custom_token(user["localId"], additional_claims)
        print("JWT Token :")
        print(custom_token)

    except Exception as e: 
        print("Authentication failed")
        print(e)
    return


# Main
ans=input("Are you a new user? [y/n]")

if ans == 'n':
    login()
elif ans == 'y':
    signup()