A security administrator needs to grant a data analyst permission to run SQL queries on a specific BigQuery dataset within a Google Cloud project, while adhering strictly to the principle of least privilege. Which of the following IAM role assignments should the administrator configure? (Select TWO.)
- Assign the BigQuery Data Viewer (roles/bigquery.dataViewer) role on the specific dataset to allow reading table data.Answer
- Assign the BigQuery Job User (roles/bigquery.jobUser) role at the project level to allow executing query jobs.Answer
- CAssign the Editor (roles/editor) primitive role at the project level to cover both data access and job execution.
- DAssign the BigQuery Admin (roles/bigquery.admin) role at the Organization level to ensure query execution rights.
Answer
To enable running SQL queries on a specific dataset under least privilege, assign the BigQuery Data Viewer role at the dataset level and the BigQuery Job User role at the project level.
Executing BigQuery queries requires both dataset read permissions and project job execution permissions. Granting BigQuery Data Viewer scoped to the specific dataset allows querying table data without altering table schemas or accessing other datasets. Granting BigQuery Job User at the project level allows running query jobs without granting access to dataset contents or administrative rights.
Step-by-Step Solution
Key Concept
Applying Least Privilege with Predefined Roles and Resource Scopes