Overview
BigQuery ML uses Identity and Access Management (IAM) to manage access to model resources. To grant access to a model resource, assign one or more IAM roles to a user, group, or service account. BigQuery ML's permissions are incorporated into the IAM roles.
This page provides details on BigQuery ML IAM permissions and roles. For more information on access controls in BigQuery, see the BigQuery access control page.
BigQuery ML permissions
The following table describes the permissions available in BigQuery ML.
For more information on BigQuery ML releases, see the Release notes.
| Permission | Description |
|---|---|
bigquery.models.create |
Create new models. |
bigquery.models.delete |
Delete models. |
bigquery.models.getData |
Get model data. To get model metadata, you need
bigquery.models.getMetadata. |
bigquery.models.getMetadata |
Get model metadata. To get model data, you need
bigquery.models.getData. |
bigquery.models.list |
List models and metadata on models. |
bigquery.models.updateData |
Update model data. To update model metadata, you need
bigquery.models.updateMetadata. |
bigquery.models.updateMetadata |
Update model metadata. To update model data, you need
bigquery.models.updateData. |
bigquery.models.create and bigquery.models.getData |
Perform ML operations: ML.PREDICT,
ML.WEIGHTS, ML.TRAINING_INFO, and ML.FEATURE_INFO |
Roles
The following table lists the BigQuery predefined IAM roles with a corresponding list of all the permissions each role includes. BigQuery ML permissions are listed along with the BigQuery permissions. Note that every permission is applicable to a particular resource type.
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
BigQuery Admin | Provides permissions to manage all resources within the project. Can manage all data within the project, and can cancel jobs from other users running within the project. |
|
Project |
roles/ |
BigQuery Connection Admin Beta |
|
||
roles/ |
BigQuery Connection User Beta |
|
||
roles/ |
BigQuery Data Editor |
When applied to a table or view, this role provides permissions to:
This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to:
When applied at the project or organization level, this role can also create new datasets. |
|
Table or view |
roles/ |
BigQuery Data Owner |
When applied to a table or view, this role provides permissions to:
This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to:
When applied at the project or organization level, this role can also create new datasets. |
|
Table or view |
roles/ |
BigQuery Data Viewer |
When applied to a table or view, this role provides permissions to:
This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to:
When applied at the project or organization level, this role can also enumerate all datasets in the project. Additional roles, however, are necessary to allow the running of jobs. |
|
Table or view |
roles/ |
BigQuery Job User | Provides permissions to run jobs, including queries, within the project. |
|
Project |
roles/ |
BigQuery Metadata Viewer |
When applied to a table or view, this role provides permissions to:
This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to:
When applied at the project or organization level, this role provides permissions to:
Additional roles are necessary to allow the running of jobs. |
|
Table or view |
roles/ |
BigQuery Read Session User | Access to create and use read sessions |
|
|
roles/ |
BigQuery Resource Admin Beta | Administer all BigQuery resources. |
|
|
roles/ |
BigQuery Resource Editor Beta | Manage all BigQuery resources, but cannot make purchasing decisions. |
|
|
roles/ |
BigQuery Resource Viewer Beta | View all BigQuery resources but cannot make changes or purchasing decisions. |
|
|
roles/ |
BigQuery User |
When applied to a dataset, this role provides the ability to read the dataset's metadata and list tables in the dataset. When applied to a project, this role also provides the ability to run jobs, including queries,
within the project. A member with this role can enumerate their own jobs, cancel their own jobs, and
enumerate datasets within a project. Additionally, allows the creation of new datasets within the
project; the creator is granted the BigQuery Data Owner role ( |
|
Dataset |
Custom roles
In addition to the predefined roles, BigQuery ML also supports custom roles. For more information, see Creating and managing custom roles in the IAM documentation.
Customers who used custom roles with BigQuery ML should note that new permissions are currently available for use with BigQuery ML, but they do not take effect until June 6, 2019. Customers with custom roles should migrate to these permissions no later than June 6, 2019. Predefined IAM roles and primitive roles are not impacted by this change.
For more information on BigQuery ML releases, see the Release notes.