BigQuery cross project access via cloud functions

Question

Let's say I have two GCP Projects, A and B. And I am the owner of both projects. When I use the UI, I can query BigQuery tables in project B from both projects. But I run into problems when I try to run a Cloud Function in project A, from which I try to access a BigQuery table in project B. Specifically I run into a 403 Access Denied: Table <>: User does not have permission to query table <>.. I am a bit confused as to why I can't access the data in B and what I need to do. In my Cloud Function all I do is:

from google.cloud import bigquery

client = bigquery.Client()
query = cient.query(<my-query>)
res = query.result()

The service account used to run the function exists in project A - how do I give it editor access to BigQuery in project B? (Or what else should I do?).

I believe you have to add the service account your Cloud Function assumes to project B. — Asdfg
You're correct. I didn't realize you could add that service account as a member in the project B IAM. That should work - will test ASAP. — CHRD

v1gnus v1gnus · Accepted Answer · 2020-05-19T16:58:43

Basically you have an issue with IAM Permissions and roles on the service account used to run the function.

You should define the role bigquery.admin on your service account and it would do the trick.

However it may not be the adequate solution in regards to best practices. The link below provides a few scenarios with examples of roles most suited to your case.

https://cloud.google.com/bigquery/docs/access-control-examples

BigQuery cross project access via cloud functions

1 Answers