How to use credentials of type external_account?

[BrummbaerFr]

Hi there!

I have a usage question about how to authenticate with the Node.js Firebase admin SDK.

I am trying to use Workload Identity Federation credentials with AWS, ie. I have a JSON config which looks like this:

{
  "type": "external_account",
  "audience": "//iam.googleapis.com/<identity_pool_provider_identifier>",
  "subject_token_type": "urn:ietf:params:aws:token-type:aws4_request",
  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/<service_account_email>:generateAccessToken",
  "token_url": "https://sts.googleapis.com/v1/token",
  "credential_source": {
    "environment_id": "aws1",
    "region_url": "http://169.254.169.254/latest/meta-data/placement/availability-zone",
    "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials",
    "regional_cred_verification_url": "https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15"
  }
}

The format of this file is specified in AIP-4117.

According to this issue, it is now possible to use credentials of type external_account when using applicationDefault().

I made sure that the GOOGLE_APPLICATION_CREDENTIALS variable is populated correctly.

I tried using the following code:

const firebase = admin.initializeApp({
      credential: admin.credential.applicationDefault(),
      projectId: process.env.GOOGLE_PROJECT_ID,
    });

firebase
      .messaging()
      .send({ /* ... notification payload ... */);

... which gives this error: Credential implementation provided to initializeApp() via the "credential" property failed to fetch a valid Google OAuth2 access token with the following error: "The caller does not have permission"..

I highly doubt I am missing permissions, since I was using the lower-level google-auth-library client to use Firebase Cloud Messaging, and it worked fine for months.
Now that the Firebase admin SDK supports external account credentials, I wanted to give it a try to be able to use all the features, but I am having this issue.

Anything I might be missing, or doing wrong?

Any help is appreciated. Thanks!