Found a solution myself. By allowing the rule to apply when there is no resource sent at all (delete), it also gets write permission. The rest of the create / update code is sent to the OR expression.
match /img { match /{fileId} { allow read, write: if request.resource == null || (request.resource.contentType.matches('image/jpeg') || request.resource.contentType.matches('image/png') || request.resource.contentType.matches('image/gif') && request.resource.size < 2 * 1024 * 1024) } }
source share