CODEWITHSUNDEEP
google-bigquerygoogle-cloud-storagerolesaccess-control
fdabhi
fdabhi

Reputation: 309

Limit access to each other's database in Google Cloud Big Query

I need to grant access to Big Query to 30 Phd Students in a University on Google Cloud Platform.

Can I give them standalone access to each of them? i.e. One student cannot see other's work unless it is granted.

Creating projects = number of students is not too cost effective.

so can I give 30 access controls to a single project ?

The students need to have full access to Big query (Create, edit, join, download, run) to their respective databases.

Upvotes: 0

Views: 934

Answers (2)

Jay
Jay

Reputation: 150

The document is indeed confusing. Don't grant any project-level permissions. Just as Katie Sinatra said, go to the dataset Web UI, in the arrow drop's "Share dataset", add email and grant "Can edit". At the time of this writing, after you do the above, the user won't be able to see the dataset in the Web UI, but s/he can still do query in the Web UI just fine if s/he specifies the table correctly, i.e. `project.dataset.table`. (i tested it.) The user can also manually add the dataset to be displayed in the web UI. Here is how to do it, https://cloud.google.com/bigquery/bigquery-web-ui#displayprojects.

What i am still confusing is: after you do the above, when the user do a query, who is paying. My guess is the user is paying. If you want the dataset's original owner (the project under which the dataset is created) to be billed, then my guess is that you need to grant project-level BigQuery Job User permission to the user/email in addition to the above. Then, the user will be able to select the project in the GCP console and hit "BigQuery" to go to the big query Web UI, and be billed under the project. (by the way, if you do this, the dataset can be seen by the user in the Web UI.)

Upvotes: 1

Katie Sinatra
Katie Sinatra

Reputation: 448

As JL-HN said, it is documented but it is a bit confusing. To give access to an specific dataset, you only need to go the dataset, in the arrow drop it down and click on "Share dataset". Then you only need to add the email of the student that will handle that dataset.

Upvotes: 1

Related Questions