Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Configurare le connessioni con i collegamenti di rete
BigQuery supporta le query federate che consentono di inviare un'istruzione di query a database esterni e di ricevere il risultato come tabella temporanea.
Le query federate utilizzano l'API BigQuery Connection per stabilire una connessione. Questo
documento mostra come aumentare la sicurezza di questa connessione.
Poiché la connessione si connette direttamente al database, devi consentire
il traffico da Google Cloud al motore del database. Per aumentare la sicurezza, devi
consentire solo il traffico proveniente dalle query BigQuery.
Questa limitazione del traffico può essere eseguita in due modi:
Definendo un indirizzo IP statico utilizzato da una connessione BigQuery e aggiungendolo alle regole firewall dell'origine dati esterna.
Creando una VPN tra BigQuery e la tua infrastruttura interna e utilizzandola per le tue query.
Entrambe queste tecniche sono supportate tramite l'utilizzo di
allegati di rete.
Prima di iniziare
Concedi i ruoli IAM (Identity and Access Management) che forniscono agli utenti le autorizzazioni necessarie
per eseguire ogni attività descritta in questo documento.
Ruoli obbligatori
Per ottenere le autorizzazioni
necessarie per configurare una connessione con i collegamenti di rete,
chiedi all'amministratore di concederti il
ruolo IAM Compute Admin (roles/compute.admin) sul progetto.
Per saperne di più sulla concessione dei ruoli, consulta Gestisci l'accesso a progetti, cartelle e organizzazioni.
Questo ruolo predefinito contiene
le autorizzazioni necessarie per configurare una connessione con i collegamenti di rete. Per vedere quali sono esattamente le autorizzazioni richieste, espandi la sezione Autorizzazioni obbligatorie:
Autorizzazioni obbligatorie
Per configurare una connessione con allegati di rete sono necessarie le seguenti autorizzazioni:
Per le regioni standard, gli allegati di rete devono trovarsi nella stessa regione della connessione. Per le connessioni nella multi-regione US, l'allegato di rete
deve trovarsi nella regione us-central1. Per le connessioni nella multi-regione EU, il collegamento di rete deve trovarsi nella regione europe-west4.
Non puoi apportare modifiche all'allegato di rete dopo averlo creato. Per
configurare qualsiasi elemento in un nuovo modo, devi ricreare il collegamento di rete.
Gli allegati di rete non possono essere eliminati a meno che il produttore (BigQuery) non elimini le risorse allocate. Per avviare la procedura di eliminazione, devi contattare l'assistenza BigQuery.
Crea un collegamento di rete
Quando crei una connessione per la federazione delle query, puoi utilizzare il parametro facoltativo
network attachment, che punta a un collegamento di rete che fornisce
la connettività alla rete da cui viene stabilita la connessione al database. Puoi creare un collegamento di rete definendo un indirizzo IP statico o creando una VPN. Per entrambe le opzioni, procedi nel seguente modo:
(Facoltativo) A seconda delle norme di sicurezza della tua organizzazione, potrebbe essere necessario
configurare il firewall Google Cloud per consentire l'uscita
creando una regola firewall
con le seguenti impostazioni:
Imposta Destinazioni su Tutte le istanze nella rete.
Imposta Intervalli IPv4 di destinazione sull'intero intervallo di indirizzi IP.
Imposta Protocolli e porte specificati sulla porta utilizzata dal tuo database.
Configura il firewall interno per consentire l'ingresso dall'indirizzo IP statico
che hai creato. Questo processo varia in base all'origine dati.
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[[["\u003cp\u003eBigQuery federated queries can connect to external databases, using the BigQuery Connection API to establish this connection.\u003c/p\u003e\n"],["\u003cp\u003eTo enhance connection security, traffic should be restricted to only originate from BigQuery queries, achieved by using either a static IP address or a VPN.\u003c/p\u003e\n"],["\u003cp\u003eNetwork attachments, which can be created with a static IP address or a VPN, are used to define this connectivity to external data sources and are compatible with SAP Datasphere connections.\u003c/p\u003e\n"],["\u003cp\u003eTo configure the connection, after creating a VPC network and subnet, you must also create a network attachment using either a Cloud NAT gateway with a static IP address or a VPN.\u003c/p\u003e\n"],["\u003cp\u003eAfter creating the network attachment, a connection is created which will include the name of this attachment, allowing the project to synchronize using a federated query.\u003c/p\u003e\n"]]],[],null,["# Configure connections with network attachments\n==============================================\n\nBigQuery supports federated queries that let you send a query\nstatement to external databases and get the result back as a temporary table.\nFederated queries use the BigQuery Connection API to establish a connection. This\ndocument shows you how to increase the security of this connection.\n\nBecause the connection connects directly to your database, you must allow\ntraffic from Google Cloud to your database engine. To increase security, you\nshould only allow traffic that comes from your BigQuery queries.\nThis traffic restriction can be accomplished in one of two ways:\n\n- By defining a static IP address that is used by a BigQuery connection and adding it to the firewall rules of the external data source.\n- By creating a VPN between BigQuery and your internal infrastructure, and using it for your queries.\n\nBoth of these techniques are supported through the use of\n[network attachments](/vpc/docs/create-manage-network-attachments).\n\nBefore you begin\n----------------\n\nGrant Identity and Access Management (IAM) roles that give users the necessary permissions\nto perform each task in this document.\n\n### Required roles\n\n\nTo get the permissions that\nyou need to configure a connection with network attachments,\n\nask your administrator to grant you the\n\n\n[Compute Admin](/iam/docs/roles-permissions/compute#compute.admin) (`roles/compute.admin`)\nIAM role on the project.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nThis predefined role contains\n\nthe permissions required to configure a connection with network attachments. To see the exact permissions that are\nrequired, expand the **Required permissions** section:\n\n\n#### Required permissions\n\nThe following permissions are required to configure a connection with network attachments:\n\n- ` compute.networkAttachments.get `\n- ` compute.networkAttachments.update`\n\n\nYou might also be able to get\nthese permissions\nwith [custom roles](/iam/docs/creating-custom-roles) or\nother [predefined roles](/iam/docs/roles-overview#predefined).\n\nFor more information about IAM roles and permissions in\nBigQuery, see\n[BigQuery IAM roles and permissions](/bigquery/docs/access-control).\n\nLimitations\n-----------\n\nConnections with network attachments are subject to the following limitations:\n\n- Network attachments are supported only for [SAP Datasphere connections](/bigquery/docs/sap-datasphere-federated-queries).\n- For standard regions, network attachments must be located in the same region as the connection. For connections in the `US` multi-region, the network attachment must be located in the `us-central1` region. For connections in the `EU` multi-region, the network attachment must be located in the `europe-west4` region.\n- You can't make any changes to your network attachment after you create it. To configure anything in a new way, you need to recreate the network attachment.\n- Network attachments can't be deleted unless the producer (BigQuery) deletes the allocated resources. To initiate the deletion process, you must [contact BigQuery support](/bigquery/docs/support).\n\nCreate a network attachment\n---------------------------\n\nWhen you create a connection for query federation, you can use the optional\nnetwork attachment parameter, which points to a network attachment that provides\nconnectivity to the network from which the connection to your database is\nestablished. You can create a network attachment by either defining a static IP\naddress or creating a VPN. For either option, do the following:\n\n1. If you don't already have one,\n [create a VPC network and subnet](/vpc/docs/create-modify-vpc-networks#create-custom-network).\n\n2. If you want to create a network attachment by defining a static IP address,\n [create a Cloud NAT gateway with a static IP address](/nat/docs/set-up-manage-network-address-translation#create-nat-gateway),\n using the network, region, and subnet that you created. If you want to\n create a network attachment by creating a VPN, create a\n [VPN that is connected to your private network](/network-connectivity/docs/vpn).\n\n3. [Create a network attachment](/vpc/docs/create-manage-network-attachments#create-manual-accept)\n using the network, region, and subnet that you created.\n\n4. Optional: Depending on your organization's security policies, you might need\n to configure your Google Cloud firewall to allow egress by\n [creating a firewall rule](/firewall/docs/using-firewalls#creating_firewall_rules)\n with the following settings:\n\n - Set **Targets** to **All instances in the network**.\n - Set **Destination IPv4 ranges** to the entire IP address range.\n - Set **Specified protocols and ports** to the port that is used by your database.\n5. Configure your internal firewall to allow ingress from the static IP address\n that you created. This process varies by data source.\n\n6. [Create a connection](/bigquery/docs/connections-api-intro), and include the\n name of the network attachment that you created.\n\n7. Run any [federated query](/bigquery/docs/federated-queries-intro) to\n synchronize your project with the network attachment.\n\nYour connection is now configured with a network attachment, and you can run\nfederated queries.\n\nPricing\n-------\n\n- Standard [federated query pricing](/bigquery/docs/federated-queries-intro#pricing) applies.\n- Using VPC is subject to [Virtual Private Cloud pricing](/vpc/pricing).\n- Using Cloud VPN is subject to [Cloud VPN pricing](/network-connectivity/docs/vpn/pricing).\n- Using Cloud NAT is subject to [Cloud NAT pricing](/nat/pricing).\n\nWhat's next\n-----------\n\n- Learn about different [connection types](/bigquery/docs/connections-api-intro).\n- Learn about [managing connections](/bigquery/docs/working-with-connections).\n- Learn about [federated queries](/bigquery/docs/federated-queries-intro)."]]
