User does not have bigquery.datasets.update permission

1
votes

I have created a dataset in Google BigQuery and downloaded the json auth file. I am trying to access tables in this dataset from python in a Jupyter Notebook, but I am getting the error:

"Forbidden: 403 PATCH https://bigquery.googleapis.com/bigquery/v2/projects/testdbt-bigquery-20200403/datasets/landing_zone_flights: Access Denied: Dataset testdbt-bigquery-20200403:landing_zone_flights: User does not have bigquery.datasets.update permission for dataset testdbt-bigquery-20200403:landing_zone_flights."

Code:

%reload_ext google.cloud.bigquery

import os
from google.cloud import bigquery
print(os.environ['GOOGLE_APPLICATION_CREDENTIALS']) 
client = bigquery.Client.from_service_account_json('~/Code/BigQuery/Test_BQ.json')
#get dataset and set permissions as Reader
dataset = client.get_dataset("landing_zone_flights")
entries = list(dataset.access_entries)
full_dataset_id = "{}.{}".format(dataset.project, dataset.dataset_id)
dataset.access_entries = entries

dataset = client.update_dataset(dataset, ["access_entries"])  # Make an API request.

print(
    "Updated dataset '{}' with modified user permissions.".format(full_dataset_id)
)

The error is:

Forbidden: 403 PATCH https://bigquery.googleapis.com/bigquery/v2/projects/testdbt-bigquery-20200403/datasets/landing_zone_flights: Access Denied: Dataset testdbt-bigquery-20200403:landing_zone_flights: User does not have bigquery.datasets.update permission for dataset testdbt-bigquery-20200403:landing_zone_flights .

What am I doing wrong? I'm able to get and list the dataset properties but unable to update or query any tables

2
pythongoogle-bigquery

2 Answers

0
votes

I was able to fix this by creating a new key with the role Project - Owner, rather than BigQuery - Reader

0
votes

If you want to use a more granular approach of allowing update in Bigquery dataset, you can use the following rules:

  1. bigquery.datasets.create
  2. bigquery.datasets.delete
  3. bigquery.datasets.update
  4. bigquery.datasets.get

This predefined roles is mentioned in there.