Question

A financial services company is setting up access controls in Google Cloud. A team of data analysts needs to run queries and view datasets in BigQuery, but they should not be able to modify IAM policies or manage other unrelated resources in the project. The security lead wants to follow Google's recommended best practice for granting appropriate access. Which type of IAM role should be assigned?

Accepted Answer

A predefined role such as BigQuery Data Viewer and BigQuery Job User, scoped to the needed capabilities

Answer

A basic role such as Project Editor, which grants broad access across the project

Answer

The Project Owner basic role, so analysts can adjust their own permissions as needed

Answer

No role at all, relying on the project's default network firewall rules for access control