Question

Your company hires and onboards new data analysts every month. Each analyst needs identical read access to a set of BigQuery datasets and Cloud Storage buckets across one project. The security team complains that manually granting IAM bindings to each new user is error-prone and hard to audit. What is the recommended approach to grant these permissions while minimizing administrative overhead?

Accepted Answer

Create a Google group, add the required predefined roles to the group at the project level, and manage access by adding or removing analysts from the group.

Answer

Grant each analyst the predefined roles individually and use a shared spreadsheet to track who has which bindings.

Answer

Create a single service account with the required roles and share its JSON key with every analyst.

Answer

Grant the Project Editor basic role to each analyst so they inherit all required permissions automatically.