如何限制谷歌云平台“BigQuery Metadata Viewer”权限？

Question

I have 10 tables under my dataset. I need to create "BigQuery Metadata Viewer" permission but would like to neglect 2 tables under my dataset. So that BigQuery Metadata Viewer policy only will be able to access 8 tables.

I see that there is "condition" tab but could not figure out how to apply such a condition here.

Answer 1

IAM condition is a nice way to solve that issue, but it's not available forBigQuery resources .

The solution here is to have 2 datasets

• One with the 8 tables and the permission to view the metadata
• one with the 2 other tables without the permission to view the metadata.

Answer 2

You can use the GRANT statement using the role bigquery.metadataViewer or dataviewer .You can set this role to table level, the user will have permission to a specific table, and won't see listed tables. In this case, you need to know the name tables.

Take a look to this example:

GRANT `roles/bigquery.metadataViewer`
ON TABLE `my_dataset._my_table`
TO "user:user@domain.com"

Additionally, you can set this role at dataset level, this will grant access to read and list all the tables from the dataset.

Here's an example:

GRANT `roles/bigquery.metadataViewer`
ON schema `project_name.dataset_name`
TO "user:mail@mail.com"