Service Account with roles/viewer primitive role not able to read dataset in the project

1
votes

I have roles/bigquery.dataViewer role for a dataset. This allows me to query data in the tables belonging to the dataset. I was given a service account that has project level viewer role. When I look at "Share Dataset" using the user account, I see "Viewer" role with one member which is the service account and "BigQuery Dataset Viewer" has 2 members with my user name and Viewers of the project. This should allow the service account to query the tables in the dataset. However, when I use bq tool I get the following error "User does not have permission to query table ..."

What else is needed to allow the Service Account to be able to query the tables in the dataset?

3
google-bigquerygoogle-cloud-iam
When you run the bq command, what is your current identity? What do you see if you run gcloud config list? – Kolban
It shows the config with account same as the service account as active. – Siva
I created another config with my user account and that works with bq just like in the gcp console. – Siva

3 Answers

3
votes

According to https://blog.jetbrains.com/datagrip/2018/07/10/using-bigquery-from-intellij-based-ide/ , you might need the following privileges:

  • BigQuery | BigQuery Data View
  • BigQuery | BigQuery Job User
  • BigQuery | BigQuery User
1
votes

After sitting with the project owner and reviewing the permissions for the service account this issue is resolved. The service account didn't have the Project Viewer permission that I assumed it has. I assumed this because when I click on "Share Dataset" it shows different roles and one of them is "Viewer" with text "Read access to all resources" and the service account was part of it. We finally ended up adding the Bigquery Data Viewer role to the service account and everything worked.

0
votes

You will need to add bigquery.jobs.create permission or bigquery.jobUser role to create run BigQuery jobs with any account, here's the official documentation for further reference.

You would probably have this permission already inherited in your main account.