Creating a Service Key for BigQuery
Comprehensive guide to create and set up a service key for BigQuery access, including API activation and role explanation
This guide will walk you through the process of creating a service key for BigQuery, allowing secure programmatic access to your BigQuery resources.
Video Demonstration
Before we dive into the written instructions, watch this video for a visual walkthrough of the process:
Why Create a Service Key?
A service key for BigQuery provides:
- Secure Access: Allows applications to authenticate with BigQuery without using personal credentials.
- Controlled Permissions: Enables fine-grained access control to BigQuery resources.
- Automation: Facilitates automated processes and CI/CD pipelines interacting with BigQuery.
Prerequisites
Before you begin, ensure you have:
- A Google Cloud Platform (GCP) account
- A project set up in GCP
Step-by-Step Guide
Follow these steps to create a service key for BigQuery:
1. Enable the BigQuery API
Open Google Cloud Console
Navigate to APIs & Services
In the left navigation menu, click on “APIs & Services” > “Dashboard”
Enable BigQuery API
Click ”+ ENABLE APIS AND SERVICES” at the top of the page Search for “BigQuery API” and select it Click “ENABLE” if it’s not already enabled
2. Navigate to the IAM & Admin Console
Access IAM & Admin
In the left navigation menu, click on “IAM & Admin” > “Service Accounts”
3. Create a New Service Account
Click 'Create Service Account'
At the top of the page, click the “Create Service Account” button
Enter Service Account Details
- Service account name: Choose a descriptive name (e.g., “bigquery-admin”) - Service account ID: This will auto-generate, but you can customize it - Description: Optional, but recommended for clarity
Click 'Create and Continue'
This will create the service account
4. Assign Roles to the Service Account
Select Roles
Choose the BigQuery Admin role for full access
Click 'Continue'
After selecting roles, click “Continue”
Grant User Access (Optional)
You can grant users access to this service account if needed
Click 'Done'
This completes the service account creation
The BigQuery Admin role provides full control over BigQuery resources, including creating, updating, and deleting datasets, tables, and jobs. It’s recommended for administrative access, but you can choose more restrictive roles based on your specific needs. Other roles include:
- BigQuery Data Viewer: Read-only access to data
- BigQuery User: Ability to run queries and jobs
- BigQuery Job User: Ability to create and manage jobs
Choose the role that best fits your use case and follows the principle of least privilege.
5. Create and Download the Key
Find Your Service Account
In the Service Accounts list, find the account you just created
Access Key Management
Click on the three dots in the “Actions” column and select “Manage keys”
Add Key
Select Key Type
Choose “JSON” as the key type and click “Create”
Save the Key
The key file will automatically download. Keep this file secure!
The JSON key file contains sensitive information. Never commit it to version control or share it publicly.
Best Practices
- Rotate your service account keys regularly
- Use the principle of least privilege when assigning roles
- Monitor and audit the usage of service accounts
For more detailed information on BigQuery security and best practices, refer to the official Google Cloud documentation.
By following this guide and watching the video demonstration, you’ve learned how to create a service key for BigQuery. Remember to keep your key secure and follow best practices for key management.