StudyCerts
StudyCertsProfessional Cloud Data Engineer
professional-cloud-data-engineer
Advanced
Gauge your current knowledge
Advanced
Gauge your current knowledge
BigQuery sharing (Analytics Hub)
...
professional-cloud-data-engineer
Gauge your current knowledge
Gauge your current knowledge
BigQuery Analytics Hub provides a secure framework for sharing data across organizational boundaries without copying files. Security is managed via Identity and Access Management (IAM), which uses specific roles to enforce the principle of least privilege. Organizations should avoid basic roles like Owner or Viewer, and instead use predefined roles tailored for exchange administrators, publishers, and subscribers. These granular roles control who can manage exchanges, publish listings, or consume data.
To share specific parts of a dataset without exposing raw tables, publishers use authorized views. This feature lets subscribers query restricted data while keeping the source tables completely hidden from direct access. Publishers can also enforce column-level security using policy tags and row-level security to filter rows based on who is querying. Additionally, dynamic data masking can automatically obscure sensitive information at query runtime.
To prevent data leaks, organizations deploy VPC Service Controls to create service perimeters around projects. Perimeter bridges allow data to flow safely between specific publisher and subscriber projects without exposing data to the public internet. Furthermore, organizations can protect shared data by using customer-managed encryption keys (CMEK) or Google-managed keys.
BigQuery Analytics Hub facilitates data sharing across organizations through zero-ETL integration, meaning data is shared without physically moving it. When a subscriber signs up for a shared listing, the system provisions a linked dataset, which is a read-only dataset pointing directly to the publisher's source objects. Users with the Analytics Hub Subscriber role can query this data as dynamic views without duplicating the physical storage files.
Within linked datasets, BigQuery supports specific objects represented as views to organize data structure and logic. These include Data Lake Objects (DLO) for raw data, Data Model Objects (DMO) for standardized schemas, and Calculated Insights Objects (CIO) for pre-aggregated metrics. For multi-cloud environments, organizations can use BigQuery Omni to query data residing in external cloud storage. To optimize performance and reduce costs when querying remote sources, subscribers can deploy materialized view replicas within their destination datasets.
Architects must account for regional availability and replication constraints when setting up data exchanges. Although BigQuery automatically replicates data across zones within a region, cross-region dataset copies must be managed manually to satisfy data residency rules. To handle disaster recovery and maintain compliance, organizations use the BigQuery Data Transfer Service to synchronize and back up critical datasets.
Because BigQuery sharing (Analytics Hub) uses a zero-copy architecture, storage and compute costs are separated. Publishers pay for data storage, while subscribers pay for the compute resources used to run queries. Subscribers can choose between on-demand and capacity-based pricing models depending on their budget and query volume. This structure ensures that publishers do not get charged for the analytical workloads run by external subscribers.
Publishers and subscribers have multiple tools to optimize query performance and control costs. Publishers can share pre-aggregated materialized views to speed up queries, and they can implement data egress restrictions to block subscribers from exporting or copying data. On the subscriber side, using partitioning and clustering on the shared tables reduces the volume of scanned data, which directly lowers query costs.
To track usage and ensure compliance, publishers and subscribers can use Cloud Logging and BigQuery's INFORMATION_SCHEMA views. The INFORMATION_SCHEMA.SHARED_DATASET_USAGE view is particularly helpful because it tracks queried resources and processed bytes across all subscriber projects. For metadata management and discovery, organizations can integrate with Data Catalog to map data lineage, while VPC Service Controls ensure perimeter security through managed ingress and egress rules.