Question

A data analytics team at your company needs to run and manage BigQuery jobs and query datasets in a shared project. A junior engineer proposes granting the team's Google group the roles/editor basic role on the project so the work is unblocked quickly. Your security team requires that all access follow least privilege while still enabling the team to fully perform their BigQuery work. What should you recommend?

Accepted Answer

Grant the group the predefined roles/bigquery.user and roles/bigquery.dataEditor (or dataViewer) roles scoped to the appropriate BigQuery resources.

Answer

Grant the group roles/editor at the project level but add an IAM condition restricting it to BigQuery API calls.

Answer

Grant the group roles/owner on the project so they can manage BigQuery resources and IAM as needed.

Answer

Grant each individual engineer roles/editor directly rather than the group to reduce the blast radius.