如何创建可访问单个数据集的Google BigQuery服务帐户？

Question

Is there any way of granting readonly access to a specific BigQuery Dataset to a given Client ID ?

I've tried using a service account, but this gives full access to all datasets.

Also tried creating a service account from a different application, and added the email address generated together with the certificate to the BigQuery > Some Dataset > Share Dataset > Can view, but this always results in a 403 "Access not Configured" error.

I'm using the server to server flow described in the documentation :

import httplib2

from apiclient.discovery import build
from oauth2client.client import SignedJwtAssertionCredentials

# REPLACE WITH YOUR Project ID
PROJECT_NUMBER = 'XXXXXXXXXXX'
# REPLACE WITH THE SERVICE ACCOUNT EMAIL FROM GOOGLE DEV CONSOLE
SERVICE_ACCOUNT_EMAIL = 'XXXXX@developer.gserviceaccount.com'

f = file('key.p12', 'rb')
key = f.read()
f.close()

credentials = SignedJwtAssertionCredentials(
    SERVICE_ACCOUNT_EMAIL,
    key,
    scope='https://www.googleapis.com/auth/bigquery.readonly')

http = httplib2.Http()
http = credentials.authorize(http)

service = build('bigquery', 'v2')
tables = service.tables()
response = tables.list(projectId=PROJECT_NUMBER, datasetId='SomeDataset').execute(http)

print(response)

I'm basically trying to provide readonly access to an external server based application to a single dataset.

Answer 1

正如Fh所指出的，需要在创建服务帐户的Google帐户中激活BigQuery API，而不管它是否将查询绑定到不同应用程序ID的BigQuery端点。