Configure Secure Bi Connection Bigquery Rls Iam

What Viewer's Credentials and Granular IAM Roles Are

Viewer's Credentials (OAuth) require individual dashboard viewers to authenticate against Google Cloud BigQuery using their own identity rather than a shared service account. Combining this credential model with predefined IAM roles at specific resource hierarchy levels enforces least-privilege access and activates fine-grained security policies.

How it meets the requirements

• Enforce Row-Level Security: When queries execute using the end user's OAuth credentials, BigQuery dynamically evaluates built-in security functions such as SESSION_USER(). This ensures that regional sales managers see only the rows authorized by the row-level security (RLS) policy.
• Enforce Column-Level Security: BigQuery evaluates the specific user's Fine-Grained Reader permissions on policy tags, masking or unmasking sensitive PII fields based on each viewer's individual authorization.
• Principle of Least Privilege: Granting roles/bigquery.jobUser on the project provides only the ability to run query jobs without exposing data, while roles/bigquery.dataViewer is restricted specifically to the target dataset rather than the entire project or organization.

Key advantages

• Dynamic Policy Enforcement: Context-aware policies (RLS and column masking) execute per user identity rather than collapsing to a static service identity.
• Granular IAM Boundary: Isolates project-level compute permissions (bigquery.jobs.create) from dataset-level storage read permissions (bigquery.tables.getData).
• Comprehensive Auditing: BigQuery Cloud Audit Logs accurately record individual user identities for every executed query instead of masking access behind a generic service account.

Why this is optimal

Using Owner's Credentials or a single service account bypasses user-specific row-level security and column-level policy tags because BigQuery sees only the service identity. Delegating the query context via Viewer's (OAuth) credentials with narrow dataset-scoped roles guarantees that security controls and least privilege are enforced natively at query execution time.