An enterprise is designing a cost-effective data lakehouse architecture on Google Cloud. Several petabytes of structured analytical data are maintained in open columnar formats (such as Parquet) across Cloud Storage buckets and external cloud object stores. The security team requires that analysts query the data using standard BigQuery SQL and authorized views with fine-grained access controls, while strictly prohibiting granting end users direct object read permissions (storage.objects.get) to the underlying storage buckets. Which architecture should you implement to meet these requirements?

Create BigLake external tables using a Cloud Resource connection for access delegation, and configure authorized views over the BigLake tables for the analysts.: ### What BigLake external tables are **BigLake external tables** extend BigQuery's compute and governance capabilities to data stored directly in object storage like **Cloud Storage**, **Amazon S3**, and **Azure Blob Storage**. They unify data lakes and warehouses by allowing analytical SQL queries on open file formats without requiring data duplication or ingestion into native storage. ### How it meets the requirements - **Access delegation without bucket permissions:** BigLake uses a **Cloud Resource connection** (backed by a dedicated service account) to access underlying storage. End consumers only require query permissions on the BigLake table or dataset, completely eliminating the need to grant users direct read permissions (`storage.objects.get`) on the Cloud Storage bucket. - **Fine-grained security & authorized views:** BigLake tables natively support BigQuery's advanced governance features, including **authorized views**, **row-level security**, and **column-level security**, allowing secure data virtualization across multi-cloud object stores. - **Cost-effectiveness & open formats:** Storing petabytes in open columnar formats (e.g., Parquet, ORC, Iceberg) in object storage avoids the costs of replicating and storing duplicate datasets in managed warehouse storage. ### Key advantages - **Single source of truth:** Preserves a unified open format in the lake while exposing SQL warehouse semantics. - **Access virtualization:** Centralizes access control within BigQuery IAM without opening object-level storage ACLs. - **Multi-cloud interoperability:** Works across Cloud Storage, Amazon S3, and Azure Blob Storage seamlessly. - **Performance optimization:** Leverages BigQuery query planning and metadata caching on external files. ### Why this is optimal This approach satisfies the enterprise's governance requirement to prevent direct bucket access while delivering high query flexibility, open-format support, and centralized security administration.