bigquery.filteredDataViewer

[mdideles]

What is the implication if the permissions is added to a custom role and granted the role at the Project level?    The documentation says not to grant manually with IAM - https://cloud.google.com/bigquery/docs/managing-row-level-security#filtered-data-viewer-role.

Please let me know your thoughts.

[mars124 · Accepted solution]

Quoted directly from docs:

The bigquery.filteredDataViewer role must not be granted through IAM to a higher-level resource, such as a table, dataset, or project. Granting the role in this way lets users view rows defined by all row-level access policies within that scope, regardless of intended restrictions. While the union of row-level access policy filters might not encompass the entire table, this practice poses a significant security risk and undermines the purpose of row-level security.

We recommend managing the bigquery.filteredDataViewer role exclusively through row-level access policies. This method ensures that principals are granted the bigquery.filteredDataViewer role implicitly and correctly, respecting the defined filter predicates for each policy.

[mdideles]

thanks.  I also read this document.  On our side, we resolved not to open this permission via a custom role.