Console

1. Go to the BigQuery page.

   Go to BigQuery

2. In the left pane, click Explorer:

   

   If you don't see the left pane, click Expand left pane to open the pane.

3. In the Explorer pane, expand your project, click Datasets, and then select a dataset.

4. Click Sharing > Permissions.

5. Click Add principal.

6. In the New principals field, enter a principal.

7. In the Select a role list, select a predefined role or a custom role.

8. Click Save.

9. To return to the dataset info, click Close.

SQL

To grant principals access to datasets, use the GRANT DCL statement:

1. In the Google Cloud console, go to the BigQuery page.

   Go to BigQuery

2. In the query editor, enter the following statement:

   GRANT `ROLE_LIST`
   ON SCHEMA RESOURCE_NAME
   TO "USER_LIST"

   Replace the following:

   • ROLE_LIST: a role or list of comma-separated roles that you want to grant
   • RESOURCE_NAME: the name of the dataset that you're granting access to

   • USER_LIST: a comma-separated list of users that the role is granted to

     For a list of valid formats, see user_list.

3. Click Run.

For more information about how to run queries, see Run an interactive query.

The following example grants the BigQuery Data Viewer role to myDataset:

GRANT `roles/bigquery.dataViewer`
ON SCHEMA `myProject`.myDataset
TO "user:user@example.com", "user:user2@example.com"

bq

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To write the existing dataset information (including access controls) to a JSON file, use the bq show command:

   bq show \
       --format=prettyjson \
       PROJECT_ID:DATASET > PATH_TO_FILE

   Replace the following:

   • PROJECT_ID: your project ID
   • DATASET: the name of your dataset
   • PATH_TO_FILE: the path to the JSON file on your local machine

3. Make changes to the access section of the JSON file. You can add to any of the specialGroup entries: projectOwners, projectWriters, projectReaders, and allAuthenticatedUsers. You can also add any of the following: userByEmail, groupByEmail, and domain.

   For example, the access section of a dataset's JSON file would look like the following:

   {
    "access": [
     {
      "role": "READER",
      "specialGroup": "projectReaders"
     },
     {
      "role": "WRITER",
      "specialGroup": "projectWriters"
     },
     {
      "role": "OWNER",
      "specialGroup": "projectOwners"
     },
     {
      "role": "READER",
      "specialGroup": "allAuthenticatedUsers"
     },
     {
      "role": "READER",
      "domain": "domain_name"
     },
     {
      "role": "WRITER",
      "userByEmail": "user_email"
     },
     {
      "role": "READER",
      "groupByEmail": "group_email"
     }
    ],
    ...
   }

4. When your edits are complete, use the bq update command and include the JSON file using the --source flag. If the dataset is in a project other than your default project, add the project ID to the dataset name in the following format: PROJECT_ID:DATASET.

     bq update 
   
     --source PATH_TO_FILE 
   
     PROJECT_ID:DATASET
     

5. To verify your access control changes, use the bq show command again without writing the information to a file:

   bq show --format=prettyjson PROJECT_ID:DATASET

Terraform

Use the google_bigquery_dataset_iam resources to update access to a dataset.

Set the access policy for a dataset

The following example shows how to use the google_bigquery_dataset_iam_policy resource to set the IAM policy for the mydataset dataset. This replaces any existing policy already attached to the dataset:

# This file sets the IAM policy for the dataset created by
# https://github.com/terraform-google-modules/terraform-docs-samples/blob/main/bigquery/bigquery_create_dataset/main.tf.
# You must place it in the same local directory as that main.tf file,
# and you must have already applied that main.tf file to create
# the "default" dataset resource with a dataset_id of "mydataset".

data "google_iam_policy" "iam_policy" {
  binding {
    role = "roles/bigquery.admin"
    members = [
      "user:user@example.com",
    ]
  }
  binding {
    role = "roles/bigquery.dataOwner"
    members = [
      "group:data.admin@example.com",
    ]
  }
  binding {
    role = "roles/bigquery.dataEditor"
    members = [
      "serviceAccount:bqcx-1234567891011-12a3@gcp-sa-bigquery-condel.iam.gserviceaccount.com",
    ]
  }
}

resource "google_bigquery_dataset_iam_policy" "dataset_iam_policy" {
  dataset_id  = google_bigquery_dataset.default.dataset_id
  policy_data = data.google_iam_policy.iam_policy.policy_data
}

Set role membership for a dataset

The following example shows how to use the google_bigquery_dataset_iam_binding resource to set membership in a given role for the mydataset dataset. This replaces any existing membership in that role. Other roles within the IAM policy for the dataset are preserved:

# This file sets membership in an IAM role for the dataset created by
# https://github.com/terraform-google-modules/terraform-docs-samples/blob/main/bigquery/bigquery_create_dataset/main.tf.
# You must place it in the same local directory as that main.tf file,
# and you must have already applied that main.tf file to create
# the "default" dataset resource with a dataset_id of "mydataset".

resource "google_bigquery_dataset_iam_binding" "dataset_iam_binding" {
  dataset_id = google_bigquery_dataset.default.dataset_id
  role       = "roles/bigquery.jobUser"

  members = [
    "user:user@example.com",
    "group:group@example.com"
  ]
}

Set role membership for a single principal

The following example shows how to use the google_bigquery_dataset_iam_member resource to update the IAM policy for the mydataset dataset to grant a role to one principal. Updating this IAM policy does not affect access for any other principals that have been granted that role for the dataset.

# This file adds a member to an IAM role for the dataset created by
# https://github.com/terraform-google-modules/terraform-docs-samples/blob/main/bigquery/bigquery_create_dataset/main.tf.
# You must place it in the same local directory as that main.tf file,
# and you must have already applied that main.tf file to create
# the "default" dataset resource with a dataset_id of "mydataset".

resource "google_bigquery_dataset_iam_member" "dataset_iam_member" {
  dataset_id = google_bigquery_dataset.default.dataset_id
  role       = "roles/bigquery.user"
  member     = "user:user@example.com"
}

To apply your Terraform configuration in a Google Cloud project, complete the steps in the following sections.

Prepare Cloud Shell

1. Launch Cloud Shell.

2. Set the default Google Cloud project where you want to apply your Terraform configurations.

   You only need to run this command once per project, and you can run it in any directory.

   export GOOGLE_CLOUD_PROJECT=PROJECT_ID

   Environment variables are overridden if you set explicit values in the Terraform configuration file.

Prepare the directory

Each Terraform configuration file must have its own directory (also called a root module).

1. In Cloud Shell, create a directory and a new file within that directory. The filename must have the .tf extension—for example main.tf. In this tutorial, the file is referred to as main.tf.

   mkdir DIRECTORY && cd DIRECTORY && touch main.tf

2. If you are following a tutorial, you can copy the sample code in each section or step.

   Copy the sample code into the newly created main.tf.

   Optionally, copy the code from GitHub. This is recommended when the Terraform snippet is part of an end-to-end solution.

3. Review and modify the sample parameters to apply to your environment.
4. Save your changes.
5. Initialize Terraform. You only need to do this once per directory.

   terraform init

   Optionally, to use the latest Google provider version, include the -upgrade option:

   terraform init -upgrade

Apply the changes

1. Review the configuration and verify that the resources that Terraform is going to create or update match your expectations:

   terraform plan

   Make corrections to the configuration as necessary.

2. Apply the Terraform configuration by running the following command and entering yes at the prompt:

   terraform apply

   Wait until Terraform displays the "Apply complete!" message.

3. Open your Google Cloud project to view the results. In the Google Cloud console, navigate to your resources in the UI to make sure that Terraform has created or updated them.

API

To apply access controls when the dataset is created, call the datasets.insert method with a defined dataset resource. To update your access controls, call the datasets.patch method and use the access property in the Dataset resource.

Because the datasets.update method replaces the entire dataset resource, datasets.patch is the preferred method for updating access controls.

Go

Java

Node.js

Python

Console

1. Go to the BigQuery page.

   Go to BigQuery

2. In the left pane, click Explorer:

   

3. In the Explorer pane, expand your project, click Datasets, and then select a dataset.

4. Click Sharing > Permissions.

   The dataset's access controls appear in the Dataset Permissions pane.

bq

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To get an existing policy and output it to a local file in JSON, use the bq show command in Cloud Shell:

   bq show \
      --format=prettyjson \
      PROJECT_ID:DATASET > PATH_TO_FILE

   Replace the following:

   • PROJECT_ID: your project ID
   • DATASET: the name of your dataset
   • PATH_TO_FILE: the path to the JSON file on your local machine

SQL

Query the INFORMATION_SCHEMA.OBJECT_PRIVILEGES view. Queries to retrieve access controls for a dataset must specify the object_name.

1. In the Google Cloud console, go to the BigQuery page.

   Go to BigQuery

2. In the query editor, enter the following statement:

   SELECT
   COLUMN_LIST
   FROM
     PROJECT_ID.`region-REGION`.INFORMATION_SCHEMA.OBJECT_PRIVILEGES
   WHERE
   object_name = "DATASET";

   Replace the following:

   • COLUMN_LIST: a comma-separated list of columns from the INFORMATION_SCHEMA.OBJECT_PRIVILEGES view
   • PROJECT_ID: your project ID
   • REGION: a region qualifier
   • DATASET: the name of a dataset in your project

3. Click Run.

For more information about how to run queries, see Run an interactive query.

Example:

This query gets access controls for mydataset.

SELECT
object_name, privilege_type, grantee
FROM
my_project.`region-us`.INFORMATION_SCHEMA.OBJECT_PRIVILEGES
WHERE
object_name = "mydataset";

The output should look like the following:

+------------------+-----------------------------+-------------------------+
|   object_name    |  privilege_type             | grantee                 |
+------------------+-----------------------------+-------------------------+
| mydataset        | roles/bigquery.dataOwner    | projectOwner:myproject  |
| mydataset        | roles/bigquery.dataViwer    | user:user@example.com   |
+------------------+-----------------------------+-------------------------+

API

To view the access controls for a dataset, call the datasets.get method with a defined dataset resource.

The access controls appear in the access property of the dataset resource.

Go

Java

Node.js

Python

Console

1. Go to the BigQuery page.

   Go to BigQuery

2. In the left pane, click Explorer:

   

3. In the Explorer pane, expand your project, click Datasets, and then select a dataset.

4. In the details panel, click Sharing > Permissions.

5. In the Dataset Permissions dialog, expand the principal whose access you want to revoke.

6. Click Remove principal.

7. In the Remove role from principal? dialog, click Remove.

8. To return to dataset details, click Close.

SQL

To remove a principal's access to a dataset, use the REVOKE DCL statement:

1. In the Google Cloud console, go to the BigQuery page.

   Go to BigQuery

2. In the query editor, enter the following statement:

   REVOKE `ROLE_LIST`
   ON SCHEMA RESOURCE_NAME
   FROM "USER_LIST"

   Replace the following:

   • ROLE_LIST: a role or list of comma-separated roles that you want to revoke
   • RESOURCE_NAME: the name of the resource that you want to revoke permission on

   • USER_LIST: a comma-separated list of users who will have their roles revoked

     For a list of valid formats, see user_list.

3. Click Run.

For more information about how to run queries, see Run an interactive query.

The following example revokes the BigQuery Data Owner role from myDataset:

REVOKE `roles/bigquery.dataOwner`
ON SCHEMA `myProject`.myDataset
FROM "group:group@example.com", "serviceAccount:user@test-project.iam.gserviceaccount.com"

bq

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To write the existing dataset information (including access controls) to a JSON file, use the bq show command:

   bq show \
       --format=prettyjson \
       PROJECT_ID:DATASET > PATH_TO_FILE

   Replace the following:

   • PROJECT_ID: your project ID
   • DATASET: the name of your dataset
   • PATH_TO_FILE: the path to the JSON file on your local machine

3. Make changes to the access section of the JSON file. You can remove any of the specialGroup entries: projectOwners, projectWriters, projectReaders, and allAuthenticatedUsers. You can also remove any of the following: userByEmail, groupByEmail, and domain.

   For example, the access section of a dataset's JSON file would look like the following:

   {
    "access": [
     {
      "role": "READER",
      "specialGroup": "projectReaders"
     },
     {
      "role": "WRITER",
      "specialGroup": "projectWriters"
     },
     {
      "role": "OWNER",
      "specialGroup": "projectOwners"
     },
     {
      "role": "READER",
      "specialGroup": "allAuthenticatedUsers"
     },
     {
      "role": "READER",
      "domain": "domain_name"
     },
     {
      "role": "WRITER",
      "userByEmail": "user_email"
     },
     {
      "role": "READER",
      "groupByEmail": "group_email"
     }
    ],
    ...
   }

4. When your edits are complete, use the bq update command and include the JSON file using the --source flag. If the dataset is in a project other than your default project, add the project ID to the dataset name in the following format: PROJECT_ID:DATASET.

     bq update 
   
         --source PATH_TO_FILE 
   
         PROJECT_ID:DATASET
     

5. To verify your access control changes, use the show command without writing the information to a file:

   bq show --format=prettyjson PROJECT_ID:DATASET

API

Call the datasets.patch method and use the access property in the Dataset resource to update your access controls.

Because the datasets.update method replaces the entire dataset resource, datasets.patch is the preferred method for updating access controls.

Go

Java

Node.js

Python

Console

1. Go to the BigQuery page.

   Go to BigQuery

2. In the left pane, click Explorer:

   

3. In the Explorer pane, expand your project, click Datasets, and then select a dataset.

4. Click Overview > Tables, and then click a table or a view.

5. Click Share > Manage permissions.

6. Click Add principal.

7. In the New principals field, enter a principal.

8. In the Select a role list, select a predefined role or a custom role.

9. Click Save.

10. To return to the table or view details, click Close.

SQL

To grant principals access to tables or views, use the GRANT DCL statement:

1. In the Google Cloud console, go to the BigQuery page.

   Go to BigQuery

2. In the query editor, enter the following statement:

   GRANT `ROLE_LIST`
   ON RESOURCE_TYPE RESOURCE_NAME
   TO "USER_LIST"

   Replace the following:

   • ROLE_LIST: a role or list of comma-separated roles that you want to grant

   • RESOURCE_TYPE: the type of resource that the role is applied to

     Supported values include TABLE, VIEW, MATERIALIZED VIEW and EXTERNAL TABLE.

   • RESOURCE_NAME: the name of the resource that you want to grant the permission on

   • USER_LIST: a comma-separated list of users that the role is granted to

     For a list of valid formats, see user_list.

3. Click Run.

For more information about how to run queries, see Run an interactive query.

The following example grants the BigQuery Data Viewer role on myTable:

GRANT `roles/bigquery.dataViewer`
ON TABLE `myProject`.myDataset.myTable
TO "user:user@example.com", "user:user2@example.com"

bq

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To grant access to a table or view, use the bq add-iam-policy-binding command:

   bq add-iam-policy-binding --member=MEMBER_TYPE:MEMBER --role=ROLE
     --table=true RESOURCE

   Replace the following:

   • MEMBER_TYPE: the type of member, such as user, group, serviceAccount, or domain.
   • MEMBER: the member's email address or domain name.
   • ROLE: the role that you want to grant to the member.
   • RESOURCE: the name of the table or view whose policy you want to update.

Terraform

Use the google_bigquery_table_iam resources to update access to a table.

Set the access policy for a table

The following example shows how to use the google_bigquery_table_iam_policy resource to set the IAM policy for the mytable table. This replaces any existing policy already attached to the table:

# This file sets the IAM policy for the table created by
# https://github.com/terraform-google-modules/terraform-docs-samples/blob/main/bigquery/bigquery_create_table/main.tf.
# You must place it in the same local directory as that main.tf file,
# and you must have already applied that main.tf file to create
# the "default" table resource with a table_id of "mytable".

data "google_iam_policy" "iam_policy" {
  binding {
    role = "roles/bigquery.dataOwner"
    members = [
      "user:user@example.com",
    ]
  }
}

resource "google_bigquery_table_iam_policy" "table_iam_policy" {
  dataset_id  = google_bigquery_table.default.dataset_id
  table_id    = google_bigquery_table.default.table_id
  policy_data = data.google_iam_policy.iam_policy.policy_data
}

Set role membership for a table

The following example shows how to use the google_bigquery_table_iam_binding resource to set membership in a given role for the mytable table. This replaces any existing membership in that role. Other roles within the IAM policy for the table are preserved.

# This file sets membership in an IAM role for the table created by
# https://github.com/terraform-google-modules/terraform-docs-samples/blob/main/bigquery/bigquery_create_table/main.tf.
# You must place it in the same local directory as that main.tf file,
# and you must have already applied that main.tf file to create
# the "default" table resource with a table_id of "mytable".

resource "google_bigquery_table_iam_binding" "table_iam_binding" {
  dataset_id = google_bigquery_table.default.dataset_id
  table_id   = google_bigquery_table.default.table_id
  role       = "roles/bigquery.dataOwner"

  members = [
    "group:group@example.com",
  ]
}

Set role membership for a single principal

The following example shows how to use the google_bigquery_table_iam_member resource to update the IAM policy for the mytable table to grant a role to one principal. Updating this IAM policy does not affect access for any other principals that have been granted that role for the dataset.

# This file adds a member to an IAM role for the table created by
# https://github.com/terraform-google-modules/terraform-docs-samples/blob/main/bigquery/bigquery_create_table/main.tf.
# You must place it in the same local directory as that main.tf file,
# and you must have already applied that main.tf file to create
# the "default" table resource with a table_id of "mytable".

resource "google_bigquery_table_iam_member" "table_iam_member" {
  dataset_id = google_bigquery_table.default.dataset_id
  table_id   = google_bigquery_table.default.table_id
  role       = "roles/bigquery.dataEditor"
  member     = "serviceAccount:bqcx-1234567891011-12a3@gcp-sa-bigquery-condel.iam.gserviceaccount.com"
}

To apply your Terraform configuration in a Google Cloud project, complete the steps in the following sections.

Prepare Cloud Shell

1. Launch Cloud Shell.

2. Set the default Google Cloud project where you want to apply your Terraform configurations.

   You only need to run this command once per project, and you can run it in any directory.

   export GOOGLE_CLOUD_PROJECT=PROJECT_ID

   Environment variables are overridden if you set explicit values in the Terraform configuration file.

Prepare the directory

Each Terraform configuration file must have its own directory (also called a root module).

1. In Cloud Shell, create a directory and a new file within that directory. The filename must have the .tf extension—for example main.tf. In this tutorial, the file is referred to as main.tf.

   mkdir DIRECTORY && cd DIRECTORY && touch main.tf

2. If you are following a tutorial, you can copy the sample code in each section or step.

   Copy the sample code into the newly created main.tf.

   Optionally, copy the code from GitHub. This is recommended when the Terraform snippet is part of an end-to-end solution.

3. Review and modify the sample parameters to apply to your environment.
4. Save your changes.
5. Initialize Terraform. You only need to do this once per directory.

   terraform init

   Optionally, to use the latest Google provider version, include the -upgrade option:

   terraform init -upgrade

Apply the changes

1. Review the configuration and verify that the resources that Terraform is going to create or update match your expectations:

   terraform plan

   Make corrections to the configuration as necessary.

2. Apply the Terraform configuration by running the following command and entering yes at the prompt:

   terraform apply

   Wait until Terraform displays the "Apply complete!" message.

3. Open your Google Cloud project to view the results. In the Google Cloud console, navigate to your resources in the UI to make sure that Terraform has created or updated them.

API

1. To retrieve the current policy, call the tables.getIamPolicy method.

2. Edit the policy to add members or access controls, or both. For the format required for the policy, see the Policy reference topic.

3. Call tables.setIamPolicy to write the updated policy.

Go

Java

Node.js

Python

Console

1. Go to the BigQuery page.

   Go to BigQuery

2. In the left pane, click Explorer:

   

3. In the Explorer pane, expand your project, click Datasets, and then select a dataset.

4. Click Overview > Tables, and then click a table or a view.

5. Click Share.

   The table or view access controls appear in the Share pane.

bq

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To get an existing access policy and output it to a local file in JSON, use the bq get-iam-policy command in Cloud Shell:

   bq get-iam-policy \
       --table=true \
       PROJECT_ID:DATASET.RESOURCE > PATH_TO_FILE

   Replace the following:

   • PROJECT_ID: your project ID
   • DATASET: the name of your dataset
   • RESOURCE: the name of the table or view whose policy you want to view
   • PATH_TO_FILE: the path to the JSON file on your local machine

SQL

Query the INFORMATION_SCHEMA.OBJECT_PRIVILEGES view. Queries to retrieve access controls for a table or view must specify the object_schema and object_name.

1. In the Google Cloud console, go to the BigQuery page.

   Go to BigQuery

2. In the query editor, enter the following statement:

   SELECT
   COLUMN_LIST
   FROM
     PROJECT_ID.`region-REGION`.INFORMATION_SCHEMA.OBJECT_PRIVILEGES
   WHERE
   object_schema = "DATASET" AND object_name = "TABLE";

   Replace the following:

   • COLUMN_LIST: a comma-separated list of columns from the INFORMATION_SCHEMA.OBJECT_PRIVILEGES view
   • PROJECT_ID: your project ID
   • REGION: a region qualifier
   • DATASET: the name of a dataset that contains the table or view
   • TABLE: the name of the table or view

3. Click Run.

For more information about how to run queries, see Run an interactive query.

Example:

SELECT
object_name, privilege_type, grantee
FROM
my_project.`region-us`.INFORMATION_SCHEMA.OBJECT_PRIVILEGES
WHERE
object_schema = "mydataset" AND object_name = "mytable";

+------------------+-----------------------------+--------------------------+
|   object_name    |  privilege_type             | grantee                  |
+------------------+-----------------------------+--------------------------+
| mytable          | roles/bigquery.dataEditor   | group:group@example.com|
| mytable          | roles/bigquery.dataOwner    | user:user@example.com|
+------------------+-----------------------------+--------------------------+

API

To retrieve the current policy, call the tables.getIamPolicy method.

Go

Java

Node.js

Console

1. Go to the BigQuery page.

   Go to BigQuery

2. In the left pane, click Explorer:

   

3. In the Explorer pane, expand your project, click Datasets, and then select a dataset.

4. Click Overview > Tables, and then click a table or a view.

5. In the details pane, click Share > Manage permissions.

6. In the Share dialog, expand the principal whose access you want to revoke.

7. Click Delete.

8. In the Remove role from principal? dialog, click Remove.

9. To return to the table or view details, click Close.

SQL

To remove access to tables or views from principals, use the REVOKE DCL statement:

1. In the Google Cloud console, go to the BigQuery page.

   Go to BigQuery

2. In the query editor, enter the following statement:

   REVOKE `ROLE_LIST`
   ON RESOURCE_TYPE RESOURCE_NAME
   FROM "USER_LIST"

   Replace the following:

   • ROLE_LIST: a role or list of comma-separated roles that you want to revoke

   • RESOURCE_TYPE: the type of resource that the role is revoked from

     Supported values include TABLE, VIEW, MATERIALIZED VIEW and EXTERNAL TABLE.

   • RESOURCE_NAME: the name of the resource that you want to revoke permission on

   • USER_LIST: a comma-separated list of users who will have their roles revoked

     For a list of valid formats, see user_list.

3. Click Run.

For more information about how to run queries, see Run an interactive query.

The following example revokes the BigQuery Data Owner role on myTable:

REVOKE `roles/bigquery.dataOwner`
ON TABLE `myProject`.myDataset.myTable
FROM "group:group@example.com", "serviceAccount:user@myproject.iam.gserviceaccount.com"

bq

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To revoke access to a table or view, use the bq remove-iam-policy-binding command:

   bq remove-iam-policy-binding --member=MEMBER_TYPE:MEMBER --role=ROLE
   --table=true RESOURCE

   Replace the following:

   • MEMBER_TYPE: the type of member, such as user, group, serviceAccount, or domain
   • MEMBER: the member's email address or domain name
   • ROLE: the role that you want to revoke from the member
   • RESOURCE: the name of the table or view whose policy you want to update

API

1. To retrieve the current policy, call the tables.getIamPolicy method.

2. Edit the policy to remove members or bindings, or both. For the format required for the policy, see the Policy reference topic.

3. Call tables.setIamPolicy to write the updated policy.

Go

Java

Node.js

Console

1. Go to the BigQuery page.

   Go to BigQuery

2. In the left pane, click Explorer:

   

3. In the Explorer pane, expand your project, click Datasets, and then select a dataset.

4. Go to the Routines tab and click a routine.

5. Click Share.

6. Click Add members.

7. In the New members field, enter a principal.

8. In the Select a role list, select a predefined role or a custom role.

9. Click Save.

10. To return to the routine info, click Done.

bq

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To write the existing routine information (including access controls) to a JSON file, use the bq get-iam-policy command:

   bq get-iam-policy \
       PROJECT_ID:DATASET.ROUTINE \
       > PATH_TO_FILE

   Replace the following:

   • PROJECT_ID: your project ID
   • DATASET: the name of the dataset that contains the routine that you want to update
   • ROUTINE: the name of the resource to update
   • PATH_TO_FILE: the path to the JSON file on your local machine

3. Make changes to the bindings section of the JSON file. A binding binds one or more principals to a single role. Principals can be user accounts, service accounts, Google groups, and domains. For example, the bindings section of a routine's JSON file would look like the following:

   {
     "bindings": [
       {
         "role": "roles/bigquery.dataViewer",
         "members": [
           "user:user@example.com",
           "group:group@example.com",
           "domain:example.com",
         ]
       },
     ],
     "etag": "BwWWja0YfJA=",
     "version": 1
   }

4. To update the access policy, use the bq set-iam-policy command:

   bq set-iam-policy PROJECT_ID:DATASET.ROUTINE PATH_TO_FILE

5. To verify your access control changes, use the bq get-iam-policy command again without writing the information to a file:

   bq get-iam-policy --format=prettyjson \\
       PROJECT_ID:DATASET.ROUTINE

API

1. To retrieve the current policy, call the routines.getIamPolicy method.

2. Edit the policy to add principals, bindings, or both. For the format required for the policy, see the Policy reference topic.

3. Call routines.setIamPolicy to write the updated policy.

Console

1. Go to the BigQuery page.

   Go to BigQuery

2. In the left pane, click Explorer:

   

3. In the Explorer pane, expand your project, click Datasets, and then select a dataset.

4. Go to the Routines tab and click a routine.

5. Click Share.

   The routine's access controls appear in the Share pane.

bq

The bq get-iam-policy command does not provide support for viewing access controls on a routine.

SQL

The INFORMATION_SCHEMA.OBJECT_PRIVILEGES view doesn't show access controls for routines.

API

To retrieve the current policy, call the routines.getIamPolicy method.

Console

1. Go to the BigQuery page.

   Go to BigQuery

2. In the left pane, click Explorer:

   

3. In the Explorer pane, expand your project, click Datasets, and then select a dataset.

4. Go to the Routines tab and click a routine.

5. In the details pane, click Share > Permissions.

6. In the Routine Permissions dialog, expand the principal whose access you want to revoke.

7. Click Remove principal.

8. In the Remove role from principal? dialog, click Remove.

9. Click Close.

bq

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To write the existing routine information (including access controls) to a JSON file, use the bq get-iam-policy command:

   bq get-iam-policy --routine PROJECT_ID:DATASET.ROUTINE > PATH_TO_FILE

   Replace the following:

   • PROJECT_ID: your project ID
   • DATASET: the name of the dataset that contains the routine that you want to update
   • ROUTINE: the name of the resource to update
   • PATH_TO_FILE: the path to the JSON file on your local machine

   In the policy file, the value for version remains 1. This number refers to the IAM policy schema version, not the version of the policy. The value for etag value is the policy version number.

3. Make changes to the access section of the JSON file. You can remove any of the specialGroup entries: projectOwners, projectWriters, projectReaders, and allAuthenticatedUsers. You can also remove any of the following: userByEmail, groupByEmail, and domain.

   For example, the access section of a routine's JSON file would look like the following:

   {
    "bindings": [
      {
        "role": "roles/bigquery.dataViewer",
        "members": [
          "user:user@example.com",
          "group:group@example.com",
          "domain:google.com",
        ]
      },
    ],
    "etag": "BwWWja0YfJA=",
    "version": 1
   }

4. To update the access policy, use the bq set-iam-policy command:

   bq set-iam-policy --routine PROJECT_ID:DATASET.ROUTINE PATH_TO_FILE

5. To verify your access control changes, use the get-iam-policy command again without writing the information to a file:

   bq get-iam-policy --routine --format=prettyjson PROJECT_ID:DATASET.ROUTINE

API

1. To retrieve the current policy, call the routines.getIamPolicy method.

2. Edit the policy to add principals or bindings, or both. For the format required for the policy, see the Policy reference topic.