A data analytics team is onboarding a new data analyst who needs to run SQL query jobs and view table data in BigQuery within a specific Google Cloud project. The team's security policy requires following the principle of least privilege by avoiding overly permissive access across other Google Cloud resources in the project. Which IAM role approach should the administrator use to grant the required access?

Assign service-specific predefined roles, such as BigQuery Job User and BigQuery Data Viewer, instead of a basic role.: ### What predefined roles are **Predefined roles** in Google Cloud are granular, service-specific Identity and Access Management (IAM) roles created and maintained by Google. Unlike basic roles, which apply broadly across all Google Cloud services in a project, predefined roles bundle specific permissions tailored to distinct job functions and individual services like **BigQuery**, **Cloud Storage**, or **Vertex AI**. ### How this meets the requirement - **Granular service access**: Assigning **BigQuery Job User** (`roles/bigquery.jobUser`) grants the exact permissions required to run query jobs (`bigquery.jobs.create`), while **BigQuery Data Viewer** (`roles/bigquery.dataViewer`) permits viewing datasets and tables without exposing unrelated services. - **Enforces least privilege**: By using predefined roles, the analyst receives only the permissions necessary for their analytical tasks, avoiding unintended access to Compute Engine, Cloud Storage, Cloud SQL, or project administrative settings. - **Scoped resource assignment**: Predefined data roles can be bound at the dataset or table level, providing refined control over sensitive data assets. ### Key advantages of predefined roles - **Service-specific isolation**: Limits access strictly to targeted APIs and operations. - **Maintained by Google**: Automatically updated when new underlying API methods or features are added to the service. - **Audit compliance**: Facilitates security audits by maintaining clear, predictable access boundaries. - **Reduced blast radius**: Minimizes potential security impact if user credentials are leaked or compromised. ### Why this is optimal Using predefined roles directly aligns with Google Cloud security best practices. Basic roles grant sweeping permissions across hundreds of cloud services simultaneously, which violates enterprise governance and the principle of least privilege.