Overview
BigQuery Data Transfer Service uses Cloud Identity and Access Management to manage access to resources. To grant access to a resource, assign one or more BigQuery Cloud IAM roles to an entity. BigQuery Data Transfer Service's permissions are incorporated into the BigQuery Cloud IAM roles.
This page provides details on BigQuery Data Transfer Service Cloud Identity and Access Management permissions and roles. For more information on access controls in BigQuery, see the BigQuery predefined roles and permissions page.
BigQuery Data Transfer Service permissions
The following table describes the permissions available in BigQuery Data Transfer Service.
| Permission | Description |
|---|---|
bigquery.transfers.get |
Get transfer metadata. |
bigquery.transfers.update |
Create, update, and delete transfers. |
Roles
The following table lists the BigQuery predefined Cloud IAM roles with a corresponding list of all the permissions each role includes. BigQuery Data Transfer Service permissions are listed along with the BigQuery permissions. Note that every permission is applicable to a particular resource type.
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
BigQuery Admin | Provides permissions to manage all resources within the project. Can manage all data within the project, and can cancel jobs from other users running within the project. |
|
Project |
roles/ |
BigQuery Connection Admin Beta |
|
||
roles/ |
BigQuery Connection User Beta |
|
||
roles/ |
BigQuery Data Editor |
When applied to a dataset, dataEditor provides permissions to:
When applied at the project or organization level, this role can also create new datasets. |
|
Dataset |
roles/ |
BigQuery Data Owner |
When applied to a dataset, dataOwner provides permissions to:
When applied at the project or organization level, this role can also create new datasets. |
|
Dataset |
roles/ |
BigQuery Data Viewer |
When applied to a dataset, dataViewer provides permissions to:
When applied at the project or organization level, this role can also enumerate all datasets in the project. Additional roles, however, are necessary to allow the running of jobs. |
|
Dataset |
roles/ |
BigQuery Job User | Provides permissions to run jobs, including queries, within the project. This role can check the existence of all jobs, enumerate their own jobs, and cancel their own jobs. |
|
Project |
roles/ |
BigQuery Metadata Viewer |
When applied at the project or organization level, metadataViewer provides permissions to:
Additional roles are necessary to allow the running of jobs. |
|
Project |
roles/ |
BigQuery Read Session User | Access to create and use read sessions |
|
|
roles/ |
BigQuery Resource Admin Beta | Administer all BigQuery resources. |
|
|
roles/ |
BigQuery User |
Provides permissions to run jobs, including queries, within the project. The
user role can enumerate their own jobs, cancel their own jobs, and enumerate
datasets within a project. Additionally, allows the creation of new datasets
within the project; the creator is granted the
bigquery.dataOwner role for these new datasets.
|
|
Project |
Custom roles
In addition to the pre-defined roles, BigQuery Data Transfer Service also supports custom roles. For more information, see Creating and managing custom roles in the Cloud IAM documentation.