Diagram
A hierarchy showing how an IAM role granted at the organization, folder, or project level flows down through datasets to tables, views, and routines, with callouts that narrower grant levels follow least privilege.
How Resource Level Controls Least Privilege in BigQuery
Resource level in BigQuery controls whether access is broad or limited to one dataset or table. Least privilege means giving each principal no more access than is needed, so administrators choose the narrowest resource level that still lets the principal do its work. Narrower grants reduce exposure because the principal receives permissions only on the data it needs and not on sibling resources.
| Grant level | Scope of access | Choose when |
|---|---|---|
| Organization, folder, or project | All BigQuery resources in that organization, folder, or project | The principal needs broad access across many datasets |
| Dataset | One specific dataset without access to other datasets in the project | The principal needs all or most tables in one dataset but nothing else |
| Table, view, or routine | One table, view, or routine without full access to its parent dataset | The principal needs only one or a few objects inside a larger dataset |
Domain 1 of 3
24 practice questions
Practice this DomainLast updated