Google BigQuery
Connect a BigQuery project and dataset for governed source access or destination exports.
Last reviewed September 15, 2026
Source and destination: A BigQuery app can let Vendo query selected warehouse data. It can also receive supported event, user, advertising, conversion, or custom exports. The sources and destinations that you create set the direction and the data contract.
Connection Modes
| Mode | Credential owner | Recommended when |
|---|---|---|
| Vendo Service Account | Vendo displays a managed principal; your GCP administrator grants it access | You want keyless setup and centrally revocable IAM access |
| Bring your own service account | Your organization creates and uploads a JSON key | Your security policy requires a dedicated customer-owned principal |
The address in the current connection form is the correct one for managed access. Do not use a service-account address that you copied from an old ticket or guide.
Data Boundary
Project access is not the same as permission to every dataset. Select the correct dataset. Grant only the roles and resources that the agreed source or destination workflow needs.
As a minimum, make a distinction between these types of access:
- Read access to discover schemas and query source tables
- Job access to run BigQuery jobs in the project
- Write access when Vendo must create or update destination tables
Use dataset-level IAM where possible. Grant project-wide owner or editor roles only when it is necessary.
Before You Connect
- Confirm the GCP project and dataset with the data owner.
- Decide if Vendo will read, write, or do both.
- Choose the access mode.
- Identify the data-location, retention, and residency requirements.
- Define the expected tables, identifiers, freshness, and reconciliation checks.
Verify the Connection
- Use Load Datasets in the BigQuery connection form.
- Select the correct dataset.
- Run the access verification in the form.
- Make sure that the read and write results match the planned direction.
- Create the source or destination.
- Run a small test and examine the actual table or query result.
A successful connection check shows that the credentials and IAM work. It does not show that a mapping, schedule, or downstream consumer is correct.
Security
- Keep service-account JSON only in the Vendo credential form. Never put it in docs, source control, or support messages.
- Rotate a customer-owned key as your organization’s policy tells you.
- Remove the principal’s access when you stop using the connection.
- Examine the source and destination logs and the GCP audit logs after permission changes.