Question

A financial services company stores sensitive customer data in BigQuery within a project named 'analytics-prod'. Security requires that data in this project cannot be exfiltrated to any Google Cloud resource outside the organization, even if an attacker obtains valid credentials. However, a separate project 'ml-training' (in the same organization) must be able to run authorized BigQuery jobs that read from 'analytics-prod'. What is the best way to meet both requirements?

Accepted Answer

Create a VPC Service Controls perimeter around 'analytics-prod' with the BigQuery API restricted, and use a perimeter bridge or ingress/egress rules to allow controlled access from 'ml-training'.

Answer

Apply an IAM deny policy on 'analytics-prod' that blocks the bigquery.jobs.create permission for all principals except the 'ml-training' service account.

Answer

Enable Private Google Access on the 'analytics-prod' subnets and add a firewall rule allowing egress only to 'ml-training'.

Answer

Configure an organization policy that restricts resource sharing to the organization's customer ID and grant the 'ml-training' service account the BigQuery Data Viewer role.