You are managing a project for the Business Intelligence (BI) department in your company. A data pipeline ingests data into BigQuery via streaming…

The roles/bigquery.user IAM role contains the bigquery.jobs.create permission, which is required to run query jobs. Assigning this role to a Google Group is the recommended best practice for managing access for a team. This approach allows for centralized and scalable management of permissions; when a user joins or leaves the BI department, an administrator only needs to update the Google Group membership, rather than modifying multiple individual IAM policies. This directly and securely fulfills the requirement for the BI team to run custom SQL queries.

A. Data Studio is a visualization and reporting tool. It does not provide an interface for users to write and execute their own ad-hoc, custom SQL queries.

B. Service accounts are intended for applications and services, not individual users. Sharing a service account and its keys among multiple people is a significant security anti-pattern that breaks the principle of individual accountability.

C. Copying data to another data warehouse is inefficient, introduces data latency, and incurs extra cost. The requirement is to query the latest data directly within BigQuery.

1. Google Cloud Documentation

BigQuery access control

"Predefined roles and permissions": The roles/bigquery.user role is described as providing permissions to run jobs

including queries

on behalf of the user. It specifically includes the bigquery.jobs.create permission.

2. Google Cloud Documentation

Identity and Access Management

"Best practices for using IAM": Under the section "Use Google Groups to manage users

" the documentation states

"We recommend that you use Google Groups to manage users... Using groups makes it easy to add and remove team members in one place instead of updating multiple IAM policies."

3. Google Cloud Documentation

Identity and Access Management

"Understanding service accounts": The documentation clarifies

"A service account is a special kind of account typically used by an application or a virtual machine (VM) instance

not a person. Applications use service accounts to make authorized API calls." This highlights why they are inappropriate for direct user access.