How-to guideDataAvailable
Grant BigQuery Service-Account Access
Grant the current Vendo or customer-owned principal the minimum BigQuery IAM access.
Last reviewed July 13, 2026
Use this guide after choosing the managed or customer-owned access mode in Vendo.
Choose the Principal
- For Vendo Service Account, copy the address displayed in the current BigQuery connection form.
- For Bring your own service account, use the
client_emailfrom the service account created for this connection.
Never copy a principal from another workspace or an old document. Managed service-account configuration can change.
Grant Access
- Open the correct project in Google Cloud Console.
- Go to IAM & Admin → IAM and select Grant access.
- Paste the chosen principal.
- Grant only the roles required by the connection:
| Role | Required for |
|---|---|
| BigQuery Data Viewer | Reading table data and metadata |
| BigQuery Job User | Running query or copy jobs in the project |
| BigQuery Data Editor | Creating or updating destination tables |
- Prefer dataset-level access for Viewer and Editor when the workflow does not need the whole project.
- Save the policy.
- Return to Vendo, load the datasets, select the intended dataset, and run access verification.
Remove Access
When retiring the connection, disable its integrations, confirm no dependent model or destination remains, revoke the principal’s IAM access, and rotate or delete any customer-owned key.
Related
Last updated on