✅ Step 1: Create the Service Account
Open the Service Accounts page in the Google Cloud Console.
Click Create Service Account.
Enter a Name (e.g. bq-reader) and optionally a Description.
Click Create and Continue.
✅ Step 2: Assign Required Roles
On the “Grant this service account access to project” screen, add the following roles:
BigQuery Data Viewer – allows viewing of table data
BigQuery Job User – allows running SQL queries
You can skip Step 3 (granting users access to the service account) and just click Done.
✅ Step 3: Generate a JSON Key
From the list of service accounts, click the service account name you just created.
Open the Keys tab.
Click Add Key → Create New Key.
Select JSON, then click Create.
A .json key file will be downloaded — keep this file secure.
✅ Step 4: Share Datasets with the Service Account
To limit access to specific datasets:
Open the BigQuery Console.
In the left panel, expand your project and click on the dataset name (not the table).
Click Share Dataset.
Enter the service account’s email (e.g. [email protected]).
Assign the BigQuery Data Viewer role.
Click Save.
🔒 This ensures the service account only has access to datasets you explicitly grant.
🧠 Summary of Roles
Task | Role Needed |
Read table data |
|
Run SQL queries |
|
Limit access to datasets | Share dataset with service account |