Querying BigQuery via zeppelin will fail because permissions are denied.

[scriptian]

1. I created a service account. ( with bigquery.admin role )
2. created a service account key 
3. set up zeppelin with service account 
4. query but failed with msg ( SQL Execution returned an error! )
5.  I checked out job and find error msg ( Access Denied: Permission bigquery.tables.getData denied on table )  / job owner is service account at 1 

I don't know what is the problem, how can I check it ?
Any help would be appreciated.

[ms4446]

The error message indicates that the service account used to set up Zeppelin does not have the necessary permissions to access the specific BigQuery table. To resolve this issue, you need to ensure the service account is granted the bigquery.tables.getData permission. This permission can be assigned either at the dataset level or directly to the table, depending on your setup. Here are the steps to grant this permission at the dataset level:

1. Navigate to the BigQuery Section:

   • Go to the BigQuery section in the Google Cloud Console.

2. Select the Dataset:

   • Choose the dataset that contains the table you are trying to query.

3. Adjust Permissions:

   • Click on "SHARE DATASET" at the top of the dataset's page.
   • Enter the email address of the service account you created for Zeppelin.
   • Assign the "BigQuery Data Viewer" role to this service account. This role includes the bigquery.tables.getData permission and allows read-only access to the dataset's tables.
   • Click "Add" and then "Done" to save the changes.

4. Verify and Test:

   • After updating the permissions, run a query from Zeppelin to ensure the service account can now access the table. Remember, permission changes might take a few minutes to propagate.

By following these steps, the service account should have the necessary permissions to query the BigQuery table, and you should no longer encounter the "Access Denied" error. Remember to adhere to the principle of least privilege and only grant the permissions necessary for the tasks the service account needs to perform.