BigQuery Job User - With IAM Condition

[ector_luiz]

I need to grant a user permission to execute queries in my project, but I also need to restrict them from using my project as a billing project and executing queries on BigQuery tables stored in other projects.

I added the 'BigQuery Job User' permission in IAM and added an IAM condition filtering by resource.name that starts with 'projects/MY_PROJECT_ID', but it's not working. The user still can't execute queries. Is there any way to restrict this access for the user so they can execute queries in my project, but cannot use it as a billing project or execute queries on BigQuery tables stored in other projects?

Regards...

[nceniza]

You can grant access to a dataset to the user by going to the share page of the a dataset:

and add them as principal to the dataset:

This can also be done with Tables and Views.

For more information you can visit this documentation for access controls for BQ: 

[ector_luiz]

Thank you for the update, @nceniza .

I had already granted access at the dataset level, even testing to include the user with "BigQuery Admin" permission. With this access, the user can view the dataset and tables, but still cannot execute queries. When attempting to execute a query on the table, the following message appears: "Access Denied: Project project-id: User does not have bigquery.jobs.create permission in project project-id."

The user is only able to execute queries when this permission is granted at the project level. However, in this case, they would also be able to execute queries in other projects they have access to, using my project as the billing project.

[nceniza]

Acknowledged.

I have tried running a query on a table level access with Bigquery Admin role it seems its possible for in my replication: 

I also asked the owner of the project to give me dataset level level permission (as a BigQuery Admin) and I was able to query the tables no problem. Can you check if the user is added to the permission here: 

[ector_luiz]

Yes, the user is listed in the dataset permissions, and as I mentioned, they have access because they can view the tables. However, the error persists when trying to execute a query.