How can I give permission to a user to access a table in a dataset in BigQuery and have the dataset appear in the project?

user_9334176 0
Viewed 713

I would like to give access to a list of tables in a dataset (not all tables) to a user.

Here is my bigquery architecture :

|Project
  |-Dataset
    |-table1
    |-table2

Let's say I want my user to see only table1.

  1. If I add a data viewer IAM permission to my user at the dataset level, the hierarchical policy causes tables 1 and 2 to inherit the IAM permission, which is not good because he can see table2
  2. If I add a data viewer IAM permission to my user at the table level, the user can access the table1 via a link or query but cannot see the dataset in the BiqQuery UI

Is there a way to make table 1 and the dataset appear without table 2?

google-iam google-bigquery dataset
2 Answers

A good solution:

  • Add an IAM metadataviewer at the dataset level.
  • Add an IAM dataviewer at the table level.

The client can see both tables (1 and 2) but can only access data from table1.

user_93341760

You can use GRANT statement to give permission to a specific table to a specific user using BigQuery. You have to grant the role that you want if it is a viewer, it would be like:

GRANT `roles/bigquery.dataViewer`
ON TABLE my_dataset.my_table
TO "user:user@domain.com"

But the role that you are searching for is bigquery.metadataViewer this role granted to a dataset will provide access to read metadata as well as list the tables. This role can also be applied to a table/view so the user will have to explicitly list the permission for the tables they wish to see and not the whole dataset.

GRANT `roles/bigquery.metadataViewer`
ON TABLE `my_dataset._my_table`
TO "user:user@domain.com"

Additionally, the Second user can pin the project. This would let him see the project, the dataset and the tables where he has access.

user_169293580
Related