Cloud Firestore Security Rules allow write only from Firebase function

Cloud Functions for Firebase code generally accesses other Firebase products using the Firebase Admin SDK. The Admin SDK will have full read and write access to Firestore, no matter how the permissions are set. You can neither explicitly allow nor deny access to the Admin SDK, which means you also can't explicitly allow nor deny access to Cloud Functions.

If you just want your backend to read and write some part of your database but none of your mobile client apps, simply reject access to all clients entirely, and let the Admin SDK do its work.

service cloud.firestore {
  match /databases/{database}/documents {

    // Match any document in the 'cities' collection
    match /cities/{city} {
      allow read: if false;
      allow write: if false;
    }
  }
}

So, I use this rule:

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read: if false;
      allow write: if false;
    }
  }
}

It's based on the above answer. It just disallows access from any client app, except the Admin SDK.