BigQuery sharing (Analytics Hub)

Enforce Security, Identity, and Governance Policies on Shared Assets

BigQuery Analytics Hub provides a secure platform for sharing data across organizations. It connects data publishers, who own and share datasets, with data subscribers, who consume that data. The service enforces strong security and governance policies to protect data throughout the sharing lifecycle.

Identity and Access Management (IAM) Roles

Identity and Access Management (IAM) controls who can perform actions on shared data. Analytics Hub uses specific, granular IAM roles to enforce the principle of least privilege. Exchange administrators manage the overall data exchange. Publishers are responsible for publishing data listings. Subscribers have the permissions needed to consume shared data. Using these predefined roles is more secure than granting broad, basic roles.

Authorized Views for Secure Data Subsets

An authorized view is a powerful tool for sharing only a specific part of a dataset. The publisher creates a view that filters the data, then authorizes specific users or groups to access that view. Subscribers can query the authorized view, but they cannot directly access the underlying source tables. This mechanism is ideal for implementing row-level or column-level security restrictions.

Column-Level and Row-Level Security

These features provide fine-grained control over data visibility within a shared dataset. Column-level security uses policy tags to mark sensitive columns. Only users granted the Fine-Grained Reader role can see data in these protected columns. Row-level security adds filters so users only see rows of data they are authorized to see, based on their identity or other conditions. These controls can be applied directly to shared tables or combined with authorized views for layered security.

VPC Service Controls and Encryption

VPC Service Controls create a security perimeter around Google Cloud resources, preventing data from being copied or accessed outside defined boundaries. Publishers can use them to isolate projects containing sensitive data. Perimeter bridges can be configured to allow controlled data flow between specific projects, which is essential for secure sharing. All data is encrypted at rest and in transit. Publishers can choose to use Google-managed encryption keys or bring their own customer-managed encryption keys (CMEK) for greater control.

Design and Manage Data Exchanges, Listings, and Linked Datasets

BigQuery Analytics Hub facilitates data collaboration by letting organizations create structured marketplaces for data. A data exchange is a collection of data listings. Publishers can create private exchanges for internal use or public exchanges for broader sharing. Subscribers browse listings and, upon subscribing, gain access to a linked dataset in their own project.

Linked Datasets and Object Types

A linked dataset is a read-only dataset in the subscriber's project that points directly to the publisher's source data; no physical data is copied. The linked dataset contains dynamic views that map to different types of objects in the publisher's project:

• Data Lake Objects (DLO): Represent raw data sources.
• Data Model Objects (DMO): Represent standardized, modeled data schemas.
• Calculated Insights Objects (CIO): Provide pre-aggregated metrics and insights.

This structure ensures all security and governance policies are enforced at the publisher's source.

Cross-Cloud and Regional Considerations

For data stored outside of Google Cloud, BigQuery Omni allows querying data residing in other cloud providers' storage. To improve performance for remote data, subscribers can create materialized view replicas, which are local, refreshed copies of the external data. Architects must also plan for regional availability. While BigQuery automatically replicates data across zones within a region, creating a cross-region copy for disaster recovery or data residency requires a manual process.

Lifecycle of a Data Share

The sharing workflow follows a specific order. First, an administrator evaluates organizational needs and creates a data exchange. Next, a publisher with the correct IAM role creates a structured listing within that exchange. Finally, a subscriber discovers the listing and subscribes, which automatically provisions the linked dataset in their project. The linked dataset remains synchronized with the source; if the publisher updates the underlying data or schema, the subscriber's view reflects those changes.

Optimize Performance, Billing Models, and Auditability of Shared Data

Analytics Hub uses a zero-copy architecture, meaning the publisher's physical data is never duplicated for sharing. This separation of storage and compute has direct implications for cost and performance optimization for both parties in the sharing relationship.

Billing Models: Publisher vs. Subscriber

The zero-copy model creates a clear financial separation. The data publisher incurs costs for storing the data in BigQuery. The data subscriber is charged for the computational resources used to query the linked dataset. Subscriber queries are billed under either the on-demand pricing model (per TB scanned) or a capacity-based model (using BigQuery slots).

Performance Optimization Techniques

Both publishers and subscribers can take steps to optimize query performance and control costs.

• Publishers can share various objects like tables, views, and materialized views. Sharing a materialized view can significantly speed up subscriber queries by providing pre-computed results.
• Subscribers benefit from the underlying structure of the shared data. If the source tables are partitioned or clustered, queries that leverage these features will scan less data, reducing cost and improving speed.
• Publishers can also set data egress restrictions on a listing. This prevents subscribers from using operations like CREATE TABLE AS SELECT that would move data out of BigQuery, ensuring query execution (and its associated costs) stay within the platform.

Monitoring and Auditing Access

Tracking usage is essential for governance and cost analysis. Publishers can view usage metrics for their shared listings, including details on jobs run by subscribers and bytes processed per project. For detailed audit trails, both parties should use:

• Cloud Logging for comprehensive activity logs.
• BigQuery's INFORMATION_SCHEMA.SHARED_DATASET_USAGE view, which provides specific insights into queried resources and bytes processed by subscribers.

Integrating with Data Catalog allows for metadata management and tracking the lineage of shared data assets, completing the governance picture.

Key Facts

• BigQuery Analytics Hub enables zero-copy data sharing, where publishers pay for storage and subscribers pay for the compute used to query linked datasets.
• Granular IAM roles for exchange administrators, publishers, and subscribers enforce the principle of least privilege for secure data sharing.
• Authorized views, column-level security, and row-level security allow publishers to share filtered subsets of data without granting direct access to source tables.
• A linked dataset is a read-only dataset in a subscriber's project that provides dynamic, policy-enforced access to a publisher's Data Lake, Data Model, or Calculated Insights objects.
• Publishers and subscribers use Cloud Logging and the INFORMATION_SCHEMA.SHARED_DATASET_USAGE view to audit query activity and monitor data consumption patterns.