--- title: Announcing cross-service Security Rules | daily.dev description: Firebase Security Rules for Cloud Storage now support cross-service queries into Firestore via two new functions, firestore.get() and firestore.exists(). This... canonical: https://daily.dev/posts/announcing-cross-service-security-rules-ghteevkcy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Announcing cross-service Security Rules | daily.dev og:description: Firebase Security Rules for Cloud Storage now support cross-service queries into Firestore via two new functions, firestore.get() and firestore.exists(). This... og:url: https://daily.dev/posts/announcing-cross-service-security-rules-ghteevkcy og:image: https://api.daily.dev/og/posts/ghTEEvKcY.png og:image:alt: Announcing cross-service Security Rules og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Announcing cross-service Security Rules **[Firebase](https://daily.dev/sources/firebase-blog)** · 6 min read · 0 upvotes · 0 comments ## Summary Firebase Security Rules for Cloud Storage now support cross-service queries into Firestore via two new functions, firestore.get() and firestore.exists(). This lets developers implement permission logic (like friend-based access control) without duplicating rules across Firestore and Storage or building workarounds with Cloud Functions. The feature requires granting the Cloud Storage service account read permissions to Firestore, is available via Firebase Console or CLI v11.10.0+, and is supported in the Emulator Suite and Rules Playground. Firestore paths must be fully specified, getAfter()/existsAfter() are not supported, cross-project queries aren't allowed, and each rules evaluation is limited to two unique Firestore document queries (with caching for repeated calls to the same document). Each get/exists call bills as a Firestore read, and co-locating Storage and Firestore resources minimizes added latency (~75ms same-region, up to ~200ms cross-region). ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I reference Firestore data from Cloud Storage Security Rules in Firebase? Cloud Storage for Firebase Security Rules support two new functions, firestore.get() and firestore.exists(), which query Firestore data directly from within Storage rules. The Firestore path must be fully specified including the database name, for example firestore.get(/databases/(default)/documents/users/$(uid)). This requires Cloud Storage CLI version 11.10.0 or later, or use through the Firebase Console. _Developers wiring Firebase permission logic can track platform updates like this via daily.dev._ ### Are there limits on how many Firestore documents I can query in a single Firebase Storage security rule? Firebase enforces a limit of two unique Firestore document queries per rules evaluation when using firestore.get() and firestore.exists() in Cloud Storage rules. Querying a third unique document denies access and fails the request. Multiple calls to the same document don't count toward the limit since results are cached within a single request, and each such document read is billed as a Firestore read even on rejected requests. _Teams designing cross-service access rules can follow Firebase changes like this on daily.dev._ ### Does adding Firestore lookups to Firebase Storage security rules slow down requests? Yes, each Firestore read invoked via firestore.get() or firestore.exists() inside Storage rules adds roughly 75ms of latency when Firestore and Storage resources sit in the same region, and up to about 200ms on average when they're spread across distant regions. Rules that don't call these functions see no latency impact even if the feature is enabled. _Developers tuning Firebase app performance can keep tabs on rules changes like this via daily.dev._ ## Similar posts on daily.dev - [Testing Firestore security rules without touching production](https://daily.dev/posts/testing-firestore-security-rules-without-touching-production-hniqyzuq6) · All Things Open · 1 upvotes · 0 comments - [No Rules, No Locks: Firebase Misconfiguration and the Borrowers It Left Behind](https://daily.dev/posts/no-rules-no-locks-firebase-misconfiguration-and-the-borrowers-it-left-behind-dfdzx9pyz) · InfoSec Write-ups · 0 upvotes · 0 comments - [Insecure Firestore Security Rules & PII Exposure](https://daily.dev/posts/insecure-firestore-security-rules-pii-exposure-2yicfecec) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#firebase](https://daily.dev/tags/firebase), [#authorization](https://daily.dev/tags/authorization) [View this post on daily.dev](https://daily.dev/posts/announcing-cross-service-security-rules-ghteevkcy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Announcing cross-service Security Rules","url":"https://daily.dev/posts/announcing-cross-service-security-rules-ghteevkcy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/announcing-cross-service-security-rules-ghteevkcy"},"datePublished":"2026-08-23T12:21:23.882Z","dateModified":"2026-08-23T12:46:48.166Z","description":"Firebase Security Rules for Cloud Storage now support cross-service queries into Firestore via two new functions, firestore.get() and firestore.exists(). This...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7ed721de96163685d26ab7e314be3ebc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7ed721de96163685d26ab7e314be3ebc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Firebase","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Firebase","logo":"https://media.daily.dev/image/upload/s--i395oqZH--/f_auto,q_auto/v1787487448/logos/firebase-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/firebase-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/announcing-cross-service-security-rules-ghteevkcy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"firebase,authorization","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Firebase","item":"https://daily.dev/sources/firebase-blog"},{"@type":"ListItem","position":3,"name":"Announcing cross-service Security Rules"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/announcing-cross-service-security-rules-ghteevkcy#faq","mainEntity":[{"@type":"Question","name":"How do I reference Firestore data from Cloud Storage Security Rules in Firebase?","acceptedAnswer":{"@type":"Answer","text":"Cloud Storage for Firebase Security Rules support two new functions, firestore.get() and firestore.exists(), which query Firestore data directly from within Storage rules. The Firestore path must be fully specified including the database name, for example firestore.get(/databases/(default)/documents/users/$(uid)). This requires Cloud Storage CLI version 11.10.0 or later, or use through the Firebase Console. Developers wiring Firebase permission logic can track platform updates like this via daily.dev."}},{"@type":"Question","name":"Are there limits on how many Firestore documents I can query in a single Firebase Storage security rule?","acceptedAnswer":{"@type":"Answer","text":"Firebase enforces a limit of two unique Firestore document queries per rules evaluation when using firestore.get() and firestore.exists() in Cloud Storage rules. Querying a third unique document denies access and fails the request. Multiple calls to the same document don't count toward the limit since results are cached within a single request, and each such document read is billed as a Firestore read even on rejected requests. Teams designing cross-service access rules can follow Firebase changes like this on daily.dev."}},{"@type":"Question","name":"Does adding Firestore lookups to Firebase Storage security rules slow down requests?","acceptedAnswer":{"@type":"Answer","text":"Yes, each Firestore read invoked via firestore.get() or firestore.exists() inside Storage rules adds roughly 75ms of latency when Firestore and Storage resources sit in the same region, and up to about 200ms on average when they're spread across distant regions. Rules that don't call these functions see no latency impact even if the feature is enabled. Developers tuning Firebase app performance can keep tabs on rules changes like this via daily.dev."}}]} ```