Bigquery Row Level Security Filtered Data Viewer Governance

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise data lake integrates Google Cloud Storage and BigQuery data assets governed by Dataplex. A data engineer needs to enforce row-level security on a centralized transactions table so regional analysts can only view data corresponding to their assigned region.

A junior administrator recommends granting the Filtered Data Viewer (roles/bigquery.filteredDataViewer) IAM role directly to the regional analyst user groups at the BigQuery dataset level, and then executing CREATE ROW ACCESS POLICY DDL statements for each region.

Why does this approach violate Google Cloud security best practices, and what is the correct implementation?

Granting Filtered Data Viewer via IAM at the dataset level allows principals to view rows permitted by all row-level policies in that dataset; principals must only be granted access by listing them directly within each DDL CREATE ROW ACCESS POLICY statement.

Assigning Filtered Data Viewer at the dataset level blocks BigQuery table pruning; principals must instead be granted BigQuery Data Viewer at the dataset level and assigned negative IAM condition tags.

The Filtered Data Viewer role requires uniform bucket-level access on Cloud Storage; you should instead configure fine-grained object ACLs on Cloud Storage and sync permissions using Dataplex.

Row-level access policies cannot be combined with IAM roles; you must grant the BigQuery Admin role to regional groups and use CREATE OR REPLACE ROW ACCESS POLICY to rotate access.

Professional Cloud Data Engineer

Bigquery Row Level Security Filtered Data Viewer Governance

Related questions