Giving guests access to our BigQuery data

We can give guests access to a single dataset (eg public_draft) in BiqQuery.

To do this they will need a Google Account (probably via gmail.com).

Then a team member with suitable permissions (probably a project-level Owner or Editor) will need to:

• Add them to the BigQuery Guest role
  • Go to https://console.cloud.google.com/iam-admin/iam?project=ebmdatalab
  • Click "Add" towards the top
  • Enter their Google Account address under "New members"
  • Choose "BigQuery Guest" from "Select a role"
  • Click "Save"
• Add them to the BigQuery DataSet Guest role for the dataset in question
  • Go to eg https://console.cloud.google.com/bigquery?project=ebmdatalab&d=public_draft&page=dataset
  • Make sure you have selected the dataset from the dropdown tree in the left-hand nav (eg open ebmdatalab, then select public_draft)
  • Click "Share dataset" halfway down
  • Enter their Google Account address under "Add members"
  • Choose "Custom" > "BigQuery Guest" from "Select a role"
  • Click "Add", then click "Done"

They should now be able to go to eg https://console.cloud.google.com/bigquery?project=ebmdatalab&d=public_draft&page=dataset and run queries against data in the dataset, and they should also be able to run queries over the API with Python or R or anything else.

---

Why two roles? Running a query involves creating a job, which is a permission which can only be granted at the project level (and so is included by BigQuery Guest. All the other permissions we want to grant should only apply at the dataset level (and so are included by BigQuery Dataset Guest).