When setting up a remote connection in BigQuery, the system automatically creates a default service account. However, it is possible to modify this service account's permissions to suit your needs.
To locate the service account, navigate to the IAM & Admin section in the Google Cloud Console after creating the remote connection. The service account associated with your remote connection typically follows a naming convention like bq-[PROJECT_NUMBER]@bigquery-encryption.iam.gserviceaccount.com. Once found, you can adjust its permissions by clicking on the service account name to view its details and then accessing the "Permissions" tab. Here, you can add or remove roles as necessary to ensure the service account has the precise level of access required for your external function. It is important to be cautious during this process to avoid inadvertently revoking permissions critical for the connection's operation.
In some cases, your external function might require authentication with a remote service. If so, you may need to manage keys for this service account, which can be done in the "Keys" tab of the service account details.
A key consideration when managing service account permissions is to follow the principle of least privilege. This principle involves granting the service account only the minimum permissions necessary, thereby enhancing security by protecting your data and resources. If you have specific security requirements or prefer more granular control, you can create a custom service account in IAM & Admin. This custom account can be associated with your remote connection during the initial setup by using the --service_account_email flag.
For detailed instructions and best practices, refer to the official BigQuery documentation on Creating and Managing Service Accounts and Remote Functions in BigQuery.
If you wish to use a custom service account during the creation of the remote connection, you can do so by specifying the service account email in the bq mk command. For instance:
bq mk --connection --location=REGION --project_id=PROJECT_ID \
--connection_type=CLOUD_RESOURCE CONNECTION_ID \
--service_account_email=YOUR_CUSTOM_SERVICE_ACCOUNT_EMAIL
LinkedIn
Twitter
