An enterprise maintains large analytical datasets across multiple cloud environments, including Amazon Simple Storage Service (Amazon S3) and Azure Blob Storage, alongside existing datasets in Google Cloud BigQuery. The enterprise needs to implement a solution that satisfies the following requirements: Data analysts must be able to run queries and analyze datasets residing in AWS and Azure without incurring ongoing cross-cloud data movement fees for raw data. Applications and workloads running in AWS and Azure must be able to access Google Cloud resources securely. The security team strictly prohibits generating, downloading, or managing long-lived service account private keys. Which architectural strategy should you recommend?

Implement BigQuery Omni with BigLake tables to query data directly in Amazon S3 and Azure Blob Storage, and configure Workload Identity Federation for keyless authentication from external cloud environments.: ### What BigQuery Omni and Workload Identity Federation Are **BigQuery Omni** is a multicloud analytics solution that extends the BigQuery query engine to execute directly in other cloud platforms such as AWS and Microsoft Azure. By utilizing **BigLake tables** that reference external object stores like **Amazon S3** and **Azure Blob Storage**, BigQuery Omni coordinates query execution locally in those clouds without moving raw datasets across cloud boundaries. **Workload Identity Federation** allows external workloads running in AWS, Azure, or on-premises systems to impersonate Google Cloud service accounts using short-lived credentials obtained via OpenID Connect (OIDC) or SAML 2.0, completely eliminating the need to create and manage long-lived service account JSON keys. ### How It Meets the Requirements - **Distributed multicloud analytics without raw data movement:** BigQuery Omni runs BigQuery compute clusters directly within the AWS or Azure regions where the data resides. Queries compute aggregations and filters locally, avoiding massive cross-cloud egress charges and raw data replication overhead. - **Unified security without long-lived keys:** Workload Identity Federation enables workloads in AWS (via AWS STS tokens) and Azure (via Microsoft Entra ID tokens) to exchange their native provider tokens for short-lived Google Cloud federated access tokens, enforcing least privilege and removing key rotation maintenance. ### Key Advantages and Capabilities - **In-place query execution:** Queries run where the data sits, significantly lowering network transfer latency and multi-cloud egress costs. - **Unified data governance:** Standardized GoogleSQL queries and centralized metadata management through BigLake across multiple clouds. - **Enhanced security posture:** Eliminates the risk of credential leakage associated with service account private keys. - **Native cloud IAM delegation:** Utilizes standard AWS IAM roles and Azure Managed Identities to authorize access to storage buckets. ### Why This Is Optimal This architecture avoids unnecessary data duplication while providing centralized analytics and governance. Combining BigQuery Omni with Workload Identity Federation establishes a modern, zero-trust multicloud architecture that satisfies both analytical agility and strict security compliance.

StudyCerts

Multicloud Analytics Bigquery Omni Workload Identity Federation | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Multicloud Analytics Bigquery Omni Workload Identity Federation

Section: Integration with on-premises/multicloud environments

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise maintains large analytical datasets across multiple cloud environments, including Amazon Simple Storage Service (Amazon S3) and Azure Blob Storage, alongside existing datasets in Google Cloud BigQuery. The enterprise needs to implement a solution that satisfies the following requirements:

Data analysts must be able to run queries and analyze datasets residing in AWS and Azure without incurring ongoing cross-cloud data movement fees for raw data.
Applications and workloads running in AWS and Azure must be able to access Google Cloud resources securely.
The security team strictly prohibits generating, downloading, or managing long-lived service account private keys.

Which architectural strategy should you recommend?

Configure Storage Transfer Service to replicate all data from Amazon S3 and Azure Blob Storage into Cloud Storage buckets, and generate JSON service account keys for external workloads.

Set up BigQuery Data Transfer Service on a recurring schedule to ingest raw tables into BigQuery, and use Cloud KMS encrypted API keys for external application access.

Deploy an Apache Spark cluster on Cloud Dataproc with cross-cloud VPN connections, and authenticate external processes using OAuth 2.0 client credentials stored in Secret Manager.

Implement BigQuery Omni with BigLake tables to query data directly in Amazon S3 and Azure Blob Storage, and configure Workload Identity Federation for keyless authentication from external cloud environments.

Professional Cloud Architect

Multicloud Analytics Bigquery Omni Workload Identity Federation

Related questions