BigQuery Permissions

Qualytics connects to BigQuery as a Google Cloud service account (see Authentication). Every profile, scan, and sync runs with that identity, so the service account must carry the BigQuery roles listed below.

In this page, the data project is the datastore's Project ID. The billing project is the connection's Billing Project ID, or the data project when that field is blank. The service account can belong to a third project; assign access to the account on the resources it uses.

Query and Read Session Roles

Grant these roles on the billing project. They are required for both source and enrichment connections and cannot be granted at dataset level:

If Billing Project ID is blank and a connection is shared across multiple data projects, grant these roles on each data project. Enable the BigQuery API and BigQuery Storage API in the project used for queries, and ensure it has billing enabled.

Source Datastore Roles (Read-Only)

Grant read access on the source datasets in the data project:

Source data remains read-only. A configured temp dataset needs separate write access for intermediate results, as described below.

Enrichment Datastore Roles (Read-Write)

An enrichment datastore also needs write access, since Qualytics creates and updates its outputs there:

The query and read session roles above are also required. Changing Billing Project ID does not move enrichment tables to another project.

Temp Dataset

The optional Temp Dataset ID names a dataset in the billing project. For example, qualytics_temp with Billing Project ID acme-billing uses acme-billing.qualytics_temp. A dataset with that name in the data project is not used when billing points elsewhere.

Create the dataset in advance and grant the service account roles/bigquery.dataEditor on that dataset so it can create, read, write, and delete intermediate tables. The dataset must be in the same BigQuery location as the queried data. Set a short default table expiration, such as one day, to remove leftover results.

If the dataset does not exist, the driver may attempt to create it. That requires bigquery.datasets.create on the billing project; roles/bigquery.jobUser does not include that permission. Pre-creating the dataset avoids giving the service account permission to create datasets across the project.

When you change or clear Billing Project ID, check the temp dataset and its permissions in the project that will now be billed. If a shared connection serves datasets in different locations, use separate connections with a temp dataset in each matching location. See Create a BigQuery Temp Dataset for the setup walkthrough.

Granting the Roles

Assign roles/bigquery.jobUser and roles/bigquery.readSessionUser to the service account in IAM & Admin of the billing project. Grant roles/bigquery.dataViewer and roles/bigquery.dataEditor through the access controls of the specific datasets Qualytics reads or writes. For the complete role definitions, see BigQuery IAM roles.