Question

A financial services company protects its BigQuery and Cloud Storage datasets inside a VPC Service Controls perimeter. A data science team in a separate project (outside the perimeter, owned by a partner analytics vendor) needs their service account to read from a specific BigQuery dataset inside the perimeter. Reads are currently blocked by VPC Service Controls. The security team wants to allow only this specific access without weakening the perimeter for other resources or identities. What should they configure?

Accepted Answer

Create an ingress rule on the perimeter specifying the vendor's service account as the source identity, the BigQuery API, and the protected project as the target

Answer

Create an egress rule on the perimeter that allows the vendor's service account identity to access the specific BigQuery service and resource project outside the perimeter

Answer

Add the vendor's project to the same perimeter so both projects can communicate freely

Answer

Add the vendor's service account to an access level based on IP ranges and attach it to the perimeter