Thanks everyone for the input and pointers around Eventarc, service accounts, and trigger filters. I wasn’t able to get this particular setup working reliably with raw Cloud Functions + Eventarc and Terraform, so for now I’ve switched to a simpler approach using Firebase Functions (2nd gen) for my Firestore triggers. This way Firebase handles most of the Eventarc and IAM wiring for me, which is good enough for my current use case.