Question

Your company protects its BigQuery and Cloud Storage resources with a VPC Service Controls perimeter around the 'analytics-prod' project. A trusted partner organization runs an analytics job from their own Google Cloud project (outside your perimeter) using a service account you have granted the appropriate IAM roles. The job fails with a VPC Service Controls violation when it tries to read from your BigQuery datasets. You must allow only this specific partner service account to access BigQuery in your perimeter, without weakening protection for any other identity or service. What should you do?

Accepted Answer

Create an ingress policy on the perimeter that specifies the partner service account as the identity, the source as any identity, and BigQuery as the allowed service and method.

Answer

Add the partner's project to an access level based on the source IP range and attach it to the perimeter so their traffic is permitted.

Answer

Create an egress rule on the perimeter allowing the partner service account to call BigQuery from the protected project.

Answer

Add both your project and the partner's project to the same VPC Service Controls perimeter so the service account is inside the trusted boundary.