Question

A financial services company runs a Google Cloud project containing production BigQuery datasets. During quarterly audits, external auditors require read-only access to specific datasets, but only for a two-week window each quarter. The security team wants to grant this access without manually revoking it afterward, without creating standing permissions, and while maintaining least privilege. What is the most appropriate way to grant this access?

Accepted Answer

Grant the auditors the BigQuery Data Viewer role with an IAM Condition that limits the binding to the specific date/time range of the audit window.

Answer

Add the auditors to a Google Group that has the BigQuery Data Viewer role, and rely on a calendar reminder to remove them after two weeks.

Answer

Grant the auditors the BigQuery Admin role at the project level so they can access all datasets, then delete the binding when the audit ends.

Answer

Create a service account with the BigQuery Data Viewer role and share its key with the auditors for the duration of the audit.