Implement Bigquery Authorized Datasets Data Mesh

What BigQuery Authorized Datasets are

BigQuery Authorized Datasets allow data product owners to authorize an entire dataset containing multiple views or user-defined functions (UDFs) to access source data stored in a separate, restricted dataset. This enables domain teams to publish virtual consumption interfaces without granting consumers direct access to raw, underlying data.

How it meets the requirements

• Sanitized virtual tables without base table permissions: Analysts are granted read permissions (roles/bigquery.dataViewer) only on the consumption dataset containing the views. When analysts execute queries against these views, the authorization is evaluated via the dataset-level authorization grant, allowing access to the underlying base tables without exposing the underlying base tables directly.
• Minimal administrative overhead at scale: Authorizing an entire dataset automatically extends authorization to any new view created within that dataset. This eliminates the need to configure and maintain authorization grants for each view individually as new data products are deployed.
• Immutable infrastructure without configuration drift: Composable Terraform modules allow the platform team to codify the dataset creation, view definitions, and IAM authorization policies into declarative source-controlled templates.

Key advantages

• Decentralized governance: Simplifies consumption interfaces across independent data mesh domains.
• Scalable authorization: Automatically applies authorization to newly created views without manual intervention.
• Zero-trust data isolation: Guarantees consumers only see permitted transformations, satisfying strict financial regulatory constraints.
• IaC reproducibility: Prevents configuration drift and enforces baseline security guardrails during deployment.

Why this is optimal

Using Authorized Datasets combined with Terraform modules provides the exact abstraction layer required for decentralized data product consumption interfaces while keeping management overhead low and maintaining rigorous access boundaries.