How to run an operation

[FloC]

Hello,

I'm just starting in Big Query and Dataform. I read a loft of documentations, and so I create my first project. I have hundred of questions, but let's start by this one : I would like to give rights dynamically, at the end of executions.

I use a lot "dbt", and in dbt, in the project.yml, you can add SQL Statement with the "on run start" and the "on run end". I did not find this in dataform. I would like to use operations to do this, but I dont find the way to start operations in the UI.

If you could help me please.

[mars124]

There is no direct Dataform equivalent to the 'on run start' and 'on run end' of dbt. Based on your intent, you can use an operation that is dependent on another run, for example:

-- grant_rights_after_run.sqlx

config {
  type: "operation",
  dependencies: ["my_table"]
}

grant
  select
on
  table `my_project.my_dataset.my_table`
to
  'user:someone@somewhere.com';

You can use a variable value for the user, as appropriate.

[nikacalupas]

Hi FloC,

Welcome to the Google Cloud Community!

Here's are suggestions on  how you can grant permissions dynamically at the end of your Dataform executions, similar to dbt's on-run-end functionality:

• Within your Dataform repository, create a new SQLX file. Inside the file construct your SQL GRANT statements. 
• In the config block, specify its type attribute to be "operations" so Dataform knows to run it after other processes.
• In the Dataform UI, you need to create a Dataform Schedule. Add your Dataform workflow (containing your data transformations and the grant_permissions.sqlx file) to the schedule. Dataform will automatically run files with type: "operations" after the rest of the scheduled data transformations complete successfully.
• The Dataform service account needs permission to modify BigQuery dataset metadata because Dataform uses this account to perform actions within BigQuery on your behalf, including granting permissions. Give the service account the roles/bigquery.dataEditor role on the relevant dataset (or, for better security, a custom role with just the bigquery.datasets.update permission).

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.