BigQuery는 통합 쿼리를 지원하므로 쿼리 문을 외부 데이터베이스에 보내고 결과를 임시 테이블로 다시 가져올 수 있습니다.
통합 쿼리는 BigQuery Connection API를 사용하여 연결을 설정합니다. 이 문서에서는 이 연결의 보안을 강화하는 방법을 보여줍니다.
연결이 데이터베이스에 직접 연결되므로 Google Cloud 에서 데이터베이스 엔진으로 가는 트래픽을 허용해야 합니다. 보안을 강화하려면 BigQuery 쿼리에서 들어오는 트래픽만 허용해야 합니다.
이러한 트래픽 제한은 다음 두 가지 방법 중 하나로 수행할 수 있습니다.
BigQuery 연결에 사용되는 고정 IP 주소를 정의하고 이를 외부 데이터 소스의 방화벽 규칙에 추가합니다.
사용자에게 이 문서의 각 작업을 수행하는 데 필요한 권한을 부여하는 Identity and Access Management(IAM) 역할을 부여합니다.
필요한 역할
네트워크 연결을 사용한 연결을 구성하는 데 필요한 권한을 얻으려면 관리자에게 프로젝트에 대한 Compute 관리자(roles/compute.admin) IAM 역할을 부여해 달라고 요청하세요.
역할 부여에 대한 자세한 내용은 프로젝트, 폴더, 조직에 대한 액세스 관리를 참조하세요.
이 사전 정의된 역할에는 네트워크 연결을 사용한 연결을 구성하는 데 필요한 권한이 포함되어 있습니다. 필요한 정확한 권한을 보려면 필수 권한 섹션을 펼치세요.
표준 리전의 경우 네트워크 연결은 연결과 동일한 리전에 있어야 합니다. US 멀티 리전의 연결의 경우 네트워크 연결이 us-central1 리전에 있어야 합니다. EU 멀티 리전의 연결의 경우 네트워크 연결이 europe-west4 리전에 있어야 합니다.
네트워크 연결을 만든 후에는 변경할 수 없습니다. 새로운 방식으로 구성하려면 네트워크 연결을 다시 만들어야 합니다.
프로듀서(BigQuery)가 할당된 리소스를 삭제하지 않으면 네트워크 연결을 삭제할 수 없습니다. 삭제 프로세스를 시작하려면 BigQuery 지원팀에 문의해야 합니다.
네트워크 연결 만들기
쿼리 통합을 위한 연결을 만들 때 데이터베이스 연결이 설정된 네트워크에 대한 연결을 제공하는 네트워크 연결을 가리키는 네트워크 연결 매개변수를 선택적으로 사용할 수 있습니다. 고정 IP 주소를 정의하거나 VPN을 만들어 네트워크 연결을 만들 수 있습니다. 두 옵션에서 모두 다음을 수행합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-26(UTC)"],[[["\u003cp\u003eBigQuery federated queries can connect to external databases, using the BigQuery Connection API to establish this connection.\u003c/p\u003e\n"],["\u003cp\u003eTo enhance connection security, traffic should be restricted to only originate from BigQuery queries, achieved by using either a static IP address or a VPN.\u003c/p\u003e\n"],["\u003cp\u003eNetwork attachments, which can be created with a static IP address or a VPN, are used to define this connectivity to external data sources and are compatible with SAP Datasphere connections.\u003c/p\u003e\n"],["\u003cp\u003eTo configure the connection, after creating a VPC network and subnet, you must also create a network attachment using either a Cloud NAT gateway with a static IP address or a VPN.\u003c/p\u003e\n"],["\u003cp\u003eAfter creating the network attachment, a connection is created which will include the name of this attachment, allowing the project to synchronize using a federated query.\u003c/p\u003e\n"]]],[],null,["# Configure connections with network attachments\n==============================================\n\nBigQuery supports federated queries that let you send a query\nstatement to external databases and get the result back as a temporary table.\nFederated queries use the BigQuery Connection API to establish a connection. This\ndocument shows you how to increase the security of this connection.\n\nBecause the connection connects directly to your database, you must allow\ntraffic from Google Cloud to your database engine. To increase security, you\nshould only allow traffic that comes from your BigQuery queries.\nThis traffic restriction can be accomplished in one of two ways:\n\n- By defining a static IP address that is used by a BigQuery connection and adding it to the firewall rules of the external data source.\n- By creating a VPN between BigQuery and your internal infrastructure, and using it for your queries.\n\nBoth of these techniques are supported through the use of\n[network attachments](/vpc/docs/create-manage-network-attachments).\n\nBefore you begin\n----------------\n\nGrant Identity and Access Management (IAM) roles that give users the necessary permissions\nto perform each task in this document.\n\n### Required roles\n\n\nTo get the permissions that\nyou need to configure a connection with network attachments,\n\nask your administrator to grant you the\n\n\n[Compute Admin](/iam/docs/roles-permissions/compute#compute.admin) (`roles/compute.admin`)\nIAM role on the project.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nThis predefined role contains\n\nthe permissions required to configure a connection with network attachments. To see the exact permissions that are\nrequired, expand the **Required permissions** section:\n\n\n#### Required permissions\n\nThe following permissions are required to configure a connection with network attachments:\n\n- ` compute.networkAttachments.get `\n- ` compute.networkAttachments.update`\n\n\nYou might also be able to get\nthese permissions\nwith [custom roles](/iam/docs/creating-custom-roles) or\nother [predefined roles](/iam/docs/roles-overview#predefined).\n\nFor more information about IAM roles and permissions in\nBigQuery, see\n[BigQuery IAM roles and permissions](/bigquery/docs/access-control).\n\nLimitations\n-----------\n\nConnections with network attachments are subject to the following limitations:\n\n- Network attachments are supported only for [SAP Datasphere connections](/bigquery/docs/sap-datasphere-federated-queries).\n- For standard regions, network attachments must be located in the same region as the connection. For connections in the `US` multi-region, the network attachment must be located in the `us-central1` region. For connections in the `EU` multi-region, the network attachment must be located in the `europe-west4` region.\n- You can't make any changes to your network attachment after you create it. To configure anything in a new way, you need to recreate the network attachment.\n- Network attachments can't be deleted unless the producer (BigQuery) deletes the allocated resources. To initiate the deletion process, you must [contact BigQuery support](/bigquery/docs/support).\n\nCreate a network attachment\n---------------------------\n\nWhen you create a connection for query federation, you can use the optional\nnetwork attachment parameter, which points to a network attachment that provides\nconnectivity to the network from which the connection to your database is\nestablished. You can create a network attachment by either defining a static IP\naddress or creating a VPN. For either option, do the following:\n\n1. If you don't already have one,\n [create a VPC network and subnet](/vpc/docs/create-modify-vpc-networks#create-custom-network).\n\n2. If you want to create a network attachment by defining a static IP address,\n [create a Cloud NAT gateway with a static IP address](/nat/docs/set-up-manage-network-address-translation#create-nat-gateway),\n using the network, region, and subnet that you created. If you want to\n create a network attachment by creating a VPN, create a\n [VPN that is connected to your private network](/network-connectivity/docs/vpn).\n\n3. [Create a network attachment](/vpc/docs/create-manage-network-attachments#create-manual-accept)\n using the network, region, and subnet that you created.\n\n4. Optional: Depending on your organization's security policies, you might need\n to configure your Google Cloud firewall to allow egress by\n [creating a firewall rule](/firewall/docs/using-firewalls#creating_firewall_rules)\n with the following settings:\n\n - Set **Targets** to **All instances in the network**.\n - Set **Destination IPv4 ranges** to the entire IP address range.\n - Set **Specified protocols and ports** to the port that is used by your database.\n5. Configure your internal firewall to allow ingress from the static IP address\n that you created. This process varies by data source.\n\n6. [Create a connection](/bigquery/docs/connections-api-intro), and include the\n name of the network attachment that you created.\n\n7. Run any [federated query](/bigquery/docs/federated-queries-intro) to\n synchronize your project with the network attachment.\n\nYour connection is now configured with a network attachment, and you can run\nfederated queries.\n\nPricing\n-------\n\n- Standard [federated query pricing](/bigquery/docs/federated-queries-intro#pricing) applies.\n- Using VPC is subject to [Virtual Private Cloud pricing](/vpc/pricing).\n- Using Cloud VPN is subject to [Cloud VPN pricing](/network-connectivity/docs/vpn/pricing).\n- Using Cloud NAT is subject to [Cloud NAT pricing](/nat/pricing).\n\nWhat's next\n-----------\n\n- Learn about different [connection types](/bigquery/docs/connections-api-intro).\n- Learn about [managing connections](/bigquery/docs/working-with-connections).\n- Learn about [federated queries](/bigquery/docs/federated-queries-intro)."]]
