How to limit Google Cloud Platform "BigQuery Metadata Viewer" permission?

user_13994040 0
Viewed 232

I have 10 tables under my dataset. I need to create "BigQuery Metadata Viewer" permission but would like to neglect 2 tables under my dataset. So that BigQuery Metadata Viewer policy only will be able to access 8 tables.

I see that there is "condition" tab but could not figure out how to apply such a condition here.

enter image description here

google-iam google-bigquery google-cloud-platform
2 Answers

IAM condition is a nice way to solve that issue, but it's not available for BigQuery resources.

The solution here is to have 2 datasets

  • One with the 8 tables and the permission to view the metadata
  • one with the 2 other tables without the permission to view the metadata.
user_113725930

You can use the GRANT statement using the role bigquery.metadataViewer or dataviewer.You can set this role to table level, the user will have permission to a specific table, and won’t see listed tables. In this case, you need to know the name tables.

Take a look to this example:

GRANT `roles/bigquery.metadataViewer`
ON TABLE `my_dataset._my_table`
TO "user:user@domain.com"

Additionally, you can set this role at dataset level, this will grant access to read and list all the tables from the dataset.

Here’s an example:

GRANT `roles/bigquery.metadataViewer`
ON schema `project_name.dataset_name`
TO "user:mail@mail.com"
user_169291450
Related