Grant BigQuery Service-Account Access

Use this guide after you choose the managed or customer-owned access mode in Vendo.

Choose the Principal

• For Vendo Service Account, copy the address that the current BigQuery connection form shows.
• For Bring your own service account, use the client_email from the service account that you created for this connection.

Never copy a principal from a different workspace or an old document. The managed service-account configuration can change.

Grant Access

1. Open the correct project in Google Cloud Console.
2. Go to IAM & Admin → IAM and select Grant access.
3. Paste the principal that you chose.
4. Grant only the roles that the connection needs:

5. If the workflow does not need the whole project, we recommend dataset-level access for Viewer and Editor.
6. Save the policy.
7. Go back to Vendo, load the datasets, select the correct dataset, and run the access verification.

Remove Access

When you stop using the connection, do these steps:

1. Disable its sources and destinations.
2. Make sure that no dependent model or destination remains.
3. Remove the IAM access of the principal.
4. Rotate or delete all customer-owned keys.

Related

• BigQuery setup
• BigQuery overview