Bigquery Authorized View Secure Data Sharing

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise stores highly sensitive customer transactional data in a centralized BigQuery dataset (raw_transactions). An external partner organization needs to query aggregated daily transaction metrics without gaining direct access to the underlying sensitive tables containing personally identifiable information (PII).

You must design a secure data sharing architecture that satisfies the following requirements:

The partner can query the pre-aggregated metrics on demand.
The partner is prevented from viewing or querying any raw data records.
The partner does not require permissions on the underlying raw_transactions dataset.
All query operations and data access events must be captured for governance and compliance audits.

Which solution should you implement?

Grant the partner roles/bigquery.dataEditor on the raw_transactions dataset and create a standard view inside raw_transactions that aggregates the metrics.

Create a new dataset containing a SQL view that aggregates data from raw_transactions. Authorize the view to access raw_transactions, grant the partner roles/bigquery.dataViewer on the new dataset, and enable BigQuery Data Access audit logs.

Configure an NFS file share using autofs on Compute Engine instances to mount raw table exports and share access with the partner via Cloud Load Balancing.

Assign the partner the roles/bigquery.admin role on the project and configure a Cloud Storage transfer service to dump aggregated tables into a public bucket.

Professional Cloud Data Engineer

Bigquery Authorized View Secure Data Sharing

Related questions