Controlling user access to our data warehouse

Now that we’ve learned about user access at the organization, folder, and project levels, we will look specifically at access control lists (ACLs) in BigQuery. An ACL is the same concept as IAM, but the ACL terminology is more commonly used when talking about the data space. Planning an ACL in BigQuery means planning who can access what in BigQuery.

At a very high level, there are two main types of GCP permission in BigQuery, as follows:

• Job permissions: BigQuery has job-level permissions. For example, for a user to be able to run a query inside the project, they need bigquery.jobs.create.

  Note that being able to run a query job doesn’t mean having access to the data. Access to the data is managed by the other permissions, which will be explained next.

• Access permissions: This one is a little bit more complicated compared to job permissions. If we talk about data access, we need to understand that the main goal...