Question

Difficulty: EasyManaging IAM Roles and Permissions

A security administrator needs to grant a data analyst permission to run SQL queries on a specific BigQuery dataset within a Google Cloud project, while adhering strictly to the principle of least privilege. Which of the following IAM role assignments should the administrator configure? (Select TWO.)

  1. Assign the BigQuery Data Viewer (roles/bigquery.dataViewer) role on the specific dataset to allow reading table data.Answer
  2. Assign the BigQuery Job User (roles/bigquery.jobUser) role at the project level to allow executing query jobs.Answer
  3. C
    Assign the Editor (roles/editor) primitive role at the project level to cover both data access and job execution.
  4. D
    Assign the BigQuery Admin (roles/bigquery.admin) role at the Organization level to ensure query execution rights.

Answer

To enable running SQL queries on a specific dataset under least privilege, assign the BigQuery Data Viewer role at the dataset level and the BigQuery Job User role at the project level.
Executing BigQuery queries requires both dataset read permissions and project job execution permissions. Granting BigQuery Data Viewer scoped to the specific dataset allows querying table data without altering table schemas or accessing other datasets. Granting BigQuery Job User at the project level allows running query jobs without granting access to dataset contents or administrative rights.

Step-by-Step Solution

1
Determine data access permission scoped to the resource.
Assigning BigQuery Data Viewer on the specific dataset provides read access to table contents without over-granting access to other datasets in the project.
The principle of least privilege requires scoping data access permissions to the specific target resource.
2
Determine job execution permission required for query processing.
Assigning BigQuery Job User at the project level grants permission to create and run query jobs.
Users must have job execution permissions in the project running the BigQuery job, independent of dataset read permissions.

Key Concept

Applying Least Privilege with Predefined Roles and Resource Scopes
Rate this question