为什么我需要 serviceusage.services.use 才能列出 BigQuery 数据集？

Question

I attempted to get a list of BigQuery datasets in a project using this command:

gcloud alpha bq datasets list --project my-project

and it failed with error:

ERROR: (gcloud.alpha.bq.datasets.list) User [me@mydomain.com] does not have permission to access projects instance [my-project] (or it may not exist): Caller does not have required permission to use project my-project. Grant the caller the roles/serviceusage.serviceUsageConsumer role, or a custom role with the serviceusage.services.use permission, by visiting https://console.developers.google.com/iam-admin/iam/project?project=my-project and then retry.

I granted myself the role:

gcloud projects add-iam-policy-binding my-project \
  --member=user:me@mydomain.com \
  --role=roles/serviceusage.serviceUsageConsumer

and then it worked:

➜ gcloud alpha bq datasets list --project my-project
ID                        LOCATION
msmg-my-project:dataset1  EU
msmg-my-project:dataset2  EU
msmg-my-project:dataset3  EU

What I don't understand is why this is required. Why do I require serviceusage.services.use in order to list BigQuery datasets?

UPDATE: This is the list of pre-defined roles that were already granted to me@mydomain.com:

• Access Context Manager Reader
• Bigtable Viewer
• Browser
• Cloud Asset Viewer
• Error Reporting User
• Logs Viewer
• Monitoring Dashboard Configuration Viewer
• Monitoring Viewer
• Organization Policy Viewer
• Security Reviewer
• Tech Support Editor
• Vertex AI Viewer

Plus one custom role that grants:

• bigquery.jobs.create
• bigquery.jobs.list
• bigquery.readsessions.create
• bigquery.readsessions.getData
• bigquery.readsessions.update
• bigquery.savedqueries.get
• bigquery.savedqueries.list
• datacatalog.tagTemplates.get
• datacatalog.tagTemplates.getTag
• datacatalog.taxonomies.get
• datacatalog.taxonomies.list

Answer 1

I asked the same question to Google Support and the support technician replied with:

when you try to use command-line with command as mentioned in the command “–project” indicates that it first tries to access the project to list the particular resources of that project, which requires roles/serviceusage.serviceUsageConsumer role

Which I think explains why I am able to see datasets in the UI but not on the command-line