StudyCerts
StudyCertsProfessional Cloud Data Engineer
professional-cloud-data-engineer
Advanced
Gauge your current knowledge
Advanced
Gauge your current knowledge
professional-cloud-data-engineer
Gauge your current knowledge
Gauge your current knowledge
Analytics Hub acts as a secure platform for sharing and publishing datasets across internal and external boundaries. It relies on the separation of storage and compute, allowing data producers to control their source assets while consumers use their own compute resources to run queries. This architecture ensures that data does not need to be replicated, which significantly reduces operational overhead. Ultimately, data publishers retain complete authority over how their datasets are accessed and governed.
To share data securely without exposing base tables, administrators rely on authorized views and authorized datasets. These features act as virtual interfaces that allow consumers to run SQL queries while protecting the underlying source schema. Producers can manage updates seamlessly through two main versioning strategies. They can use dataset versioning, which changes the dataset name itself while keeping the view names identical inside. Alternatively, they can use view versioning, keeping the dataset name constant but appending version identifiers to the views themselves.
For software-as-a-service (SaaS) environments, architects must decide between shared and dedicated tenant models. Choosing dedicated tenant projects colocates customer datasets with specific compute resources, which simplifies billing accountability and performance isolation. To manage compute costs effectively within these projects, administrators use BigQuery reservations to assign slot capacities to different tenants using fair scheduling algorithms. Enforcing strict Identity and Access Management (IAM) controls and disabling service account key creation are highly recommended over relying solely on perimeter boundaries.
Data Catalog, which is transitioning to Dataplex Universal Catalog, is a fully managed service for data discovery and metadata management. Technical metadata, such as table names and schemas, are automatically registered for BigQuery tables, authorized views, and BigLake views. To enable self-service discovery, data producers can also catalog Pub/Sub topics and Cloud Storage filesets. This centralized catalog allows consumers to search for and locate the interfaces they need to access published data.
BigQuery sharing enables organizations to publish and subscribe to data across organizational boundaries using a zero-copy sharing model. Subscribers access data in place, which means publishers do not need to replicate datasets to share them. To manage costs, publishers can use Requester Pays in Cloud Storage to shift data access fees to the consumers. In BigQuery, publishers pay for data storage while subscribers pay for their own query costs under on-demand or capacity-based pricing.
Data Catalog uses metadata tags to track encryption methods, de-identification techniques, retention policies, and data quality metrics. These tags help automate security policies and monitor compliance, with any errors or discrepancies reported through Pub/Sub. Data access is governed by formal provider and consumer agreements. Provider agreements are stored in a dedicated BigQuery warehouse linked to Data Catalog tags, while consumer agreements connect directly to IAM bindings.
Access governance ensures that data sharing follows the principle of least privilege, granting users only the minimum access needed for their work. The first layer of defense uses IAM roles, where administrators can select predefined roles or build custom roles for precise control. To share specific results without exposing the underlying base tables, publishers configure authorized views and authorized datasets. This setup allows external users to run analytical queries while keeping the main table schemas hidden.
To enforce access controls within a single table, administrators configure row-level security (RLS) and column-level security (CLS). Row-level security uses policy tags or SQL statements to filter which rows a user can see based on their identity or group. Column-level security restricts access to specific sensitive columns, such as personal identification numbers. To protect sensitive values at query time, dynamic data masking can be applied to obscure data for unauthorized users while showing the full details to authorized users.
For high-security environments, VPC Service Controls establishes a security perimeter around BigQuery resources to prevent unauthorized data exfiltration. All user queries and access requests are recorded in audit logs to support compliance tracking and security investigations. When publishing datasets through Analytics Hub, publishers can enable data egress restrictions on a linked dataset. This restriction blocks subscribers from copying, exporting, or creating new tables from the shared data, keeping the assets secure.