Why do I require serviceusage.services.use in order to list BigQuery datasets?

jamiet 0
Viewed 51

I attempted to get a list of BigQuery datasets in a project using this command:

gcloud alpha bq datasets list --project my-project

and it failed with error:

ERROR: (gcloud.alpha.bq.datasets.list) User [me@mydomain.com] does not have permission to access projects instance [my-project] (or it may not exist): Caller does not have required permission to use project my-project. Grant the caller the roles/serviceusage.serviceUsageConsumer role, or a custom role with the serviceusage.services.use permission, by visiting https://console.developers.google.com/iam-admin/iam/project?project=my-project and then retry.

I granted myself the role:

gcloud projects add-iam-policy-binding my-project \
  --member=user:me@mydomain.com \
  --role=roles/serviceusage.serviceUsageConsumer

and then it worked:

➜ gcloud alpha bq datasets list --project my-project
ID                        LOCATION
msmg-my-project:dataset1  EU
msmg-my-project:dataset2  EU
msmg-my-project:dataset3  EU

What I don't understand is why this is required. Why do I require serviceusage.services.use in order to list BigQuery datasets?

UPDATE: This is the list of pre-defined roles that were already granted to me@mydomain.com:

  • Access Context Manager Reader
  • Bigtable Viewer
  • Browser
  • Cloud Asset Viewer
  • Error Reporting User
  • Logs Viewer
  • Monitoring Dashboard Configuration Viewer
  • Monitoring Viewer
  • Organization Policy Viewer
  • Security Reviewer
  • Tech Support Editor
  • Vertex AI Viewer

Plus one custom role that grants:

  • bigquery.jobs.create
  • bigquery.jobs.list
  • bigquery.readsessions.create
  • bigquery.readsessions.getData
  • bigquery.readsessions.update
  • bigquery.savedqueries.get
  • bigquery.savedqueries.list
  • datacatalog.tagTemplates.get
  • datacatalog.tagTemplates.getTag
  • datacatalog.taxonomies.get
  • datacatalog.taxonomies.list
google-bigquery
1 Answers

I asked the same question to Google Support and the support technician replied with:

when you try to use command-line with command as mentioned in the command “–project” indicates that it first tries to access the project to list the particular resources of that project, which requires roles/serviceusage.serviceUsageConsumer role

Which I think explains why I am able to see datasets in the UI but not on the command-line

jamiet0
Related