Question

Your company runs a Dataflow streaming pipeline that reads from Pub/Sub, enriches records with lookups in a BigQuery reference dataset, and writes results to a separate BigQuery dataset. A security review requires that the pipeline's service account follow least-privilege principles and that no human users be able to assume it directly. Which IAM configuration best satisfies these requirements?

Accepted Answer

Create a dedicated user-managed service account granted roles/pubsub.subscriber on the subscription, roles/bigquery.dataViewer on the reference dataset, roles/bigquery.dataEditor on the output dataset, and roles/dataflow.worker; do not grant any user the Service Account User role on it in production.

Answer

Use the default Compute Engine service account with the Editor role so the pipeline has all permissions it might need, and rely on VPC Service Controls for restriction.

Answer

Create a service account with roles/bigquery.admin and roles/pubsub.admin, and grant the data engineering team roles/iam.serviceAccountUser so they can redeploy the pipeline as that account.

Answer

Grant the individual developers' user accounts the required BigQuery and Pub/Sub roles directly, and run the Dataflow job under their credentials.