BigQuery Permissions
Qualytics connects to BigQuery as a Google Cloud service account (see Authentication). Every profile, scan, and sync runs with that identity, so the service account must carry the BigQuery roles listed below.
Source Datastore Roles (Read-Only)
For a source datastore, Qualytics only reads data and metadata:
| ROLE | PURPOSE |
|---|---|
roles/bigquery.dataViewer |
View datasets, tables, and their data. |
roles/bigquery.jobUser |
Run jobs such as queries. Must be granted at the project level. |
roles/bigquery.readSessionUser |
Create read sessions on the BigQuery Storage Read API for efficient retrieval of large data volumes. |
Enrichment Datastore Roles (Read-Write)
An enrichment datastore also needs write access, since Qualytics creates and updates the enrichment tables:
| ROLE | PURPOSE |
|---|---|
roles/bigquery.dataEditor |
Modify data, add new tables, and change table schemas. |
roles/bigquery.dataViewer |
View datasets, tables, and their data. |
roles/bigquery.jobUser |
Run jobs such as queries and data loading. Must be granted at the project level. |
roles/bigquery.readSessionUser |
Create read sessions for efficient data retrieval. |
Temp Dataset
The connection form accepts an optional Temp Dataset ID: a dataset where the BigQuery JDBC driver stores large query results and temporary tables. When reusing a temp dataset that already exists, the service account must have the bigquery.tables.create permission on it. See Create a BigQuery Temp Dataset for the setup walkthrough.
Granting the Roles
Assign the roles to the service account in IAM & Admin of the Google Cloud project. roles/bigquery.jobUser must be granted at the project level; the other roles can be scoped to the specific datasets Qualytics reads or writes.