> For the complete documentation index, see [llms.txt](https://documentation.immuta.com/SaaS/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.immuta.com/SaaS/configuration/integrations/google-bigquery/google-bigquery-viewless-integration/register-a-google-bigquery-connection.md).

# Register a Google BigQuery Connection

{% hint style="info" %}
**Public preview**: This integration is available to all accounts that request to enable it for their tenant. Contact your Immuta representative to enable it.
{% endhint %}

## Requirements

* BigQuery Enterprise or Enterprise Plus edition
* The following APIs must be enabled in your Google Cloud project
  * [BigQuery API](https://cloud.google.com/endpoints/docs/openapi/enable-api#enabling_an_api)
  * [Cloud Identity API](https://developers.google.com/workspace/guides/enable-apis) (`cloudidentity.googleapis.com`)
  * [Cloud Resource Manager API](https://docs.cloud.google.com/resource-manager/reference/rest) (`cloudresourcemanager.googleapis.com`)
  * [IAM API](https://docs.cloud.google.com/bigquery/docs/conditions#enable-api) (`iam.googleapis.com`)

## Permissions

The user registering the connection must have the permissions below.

* `APPLICATION_ADMIN` Immuta permission
* The Google BigQuery user setting up the connection must be able to
  * Create a service account and grant that service account the necessary BigQuery permissions. To do so, the setup user needs the following permissions:
    * `roles/iam.serviceAccountCreator`
    * `roles/iam.serviceAccountAdmin`
    * `roles/resourcemanager.projectIamAdmin` (or a project owner)
  * Create a JSON key

## Create a Google Cloud service account and custom role

Create the prerequisite role, service account, and private key file for Immuta to connect to Google BigQuery.

1. [Create a custom role using the console](https://cloud.google.com/iam/docs/creating-custom-roles#creating_a_custom_role) and bind it to the project or the specific datasets you want ingested in Immuta. The custom role should have the following privileges:
   1. At the GCP organization level: `resourcemanager.organizations.get`
   2. At the GCP project level:
      * `bigquery.datasets.create`
      * `bigquery.datasets.delete`
      * `bigquery.datasets.get`
      * `bigquery.datasets.update`
      * `bigquery.jobs.create`
      * `bigquery.routines.create`
      * `bigquery.routines.delete`
      * `bigquery.routines.get`
      * `bigquery.routines.update`
      * `bigquery.rowAccessPolicies.create`
      * `bigquery.rowAccessPolicies.delete`
      * `bigquery.rowAccessPolicies.list`
      * `bigquery.rowAccessPolicies.setIamPolicy`
      * `bigquery.rowAccessPolicies.update`
      * `bigquery.tables.create`
      * `bigquery.tables.delete`
      * `bigquery.tables.get`
      * `bigquery.tables.getData`
      * `bigquery.tables.getIamPolicy`
      * `bigquery.tables.list`
      * `bigquery.tables.setIamPolicy`
      * `bigquery.tables.update`
      * `bigquery.tables.updateData`
      * `iam.roles.create`
      * `iam.roles.get`
      * `iam.roles.list`
      * `iam.roles.undelete`
      * `iam.roles.update`
      * `resourcemanager.projects.getIamPolicy`
      * `resourcemanager.projects.setIamPolicy`
2. [Create a service account](https://cloud.google.com/iam/docs/creating-managing-service-accounts#creating). The service account should have the following privileges:
   1. Group `Create` privilege and privilege required to apply security label on group resource
   2. `Group Editor` scoped to `Access to Security Groups Only` 
3. Grant the service account the custom role you just created.

You will use the private key file generated after completing these steps to register your Google BigQuery connection.

{% hint style="info" %}
**BigQuery users with access to Immuta-governed BigQuery data sources will be able to read the `immuta_profiles` table**

Google BigQuery states that grantees must have the `bigquery.tables.getData` permission on the target and referenced tables in policies. Because Immuta policy predicates read `immuta_profiles` for every entitlement check, Immuta grants every user querying a protected table read access to `immuta_profiles`.
{% endhint %}

## Register a Google BigQuery connection

1. In Immuta, click <i class="fa-database">:database:</i> **Data** and select **Connections** in the navigation menu.
2. Click the **+ Add Connection** button.
3. Select the **Google BigQuery** tile.
4. Enter the connection information:
   1. **Display Name:** This is the name of your new connection. This name will be used in the API (`connectionKey`), in data source names from the host, and on the connections page. Avoid the use of periods (`.`) or [restricted words](#user-content-fn-1)[^1] in your connection name.
   2. Upload your GCP **Service Account Key JSON File**. This is the private key file generated in create a Google Cloud service account and role for Immuta to use to connect to Google BigQuery. Uploading this file will auto-populate the following fields:
      1. **Project ID**: The Google Cloud Platform project to operate on (where your Google BigQuery data warehouse is located).
      2. **Service Account**: The service account you created.
   3. **Location**: This is the location or region used for the dataset and query operations.
   4. **Directory Customer ID:** This is the Google Workspace customer ID for the organization that the governed BigQuery project belongs to. See the [Google Workspace documentation](https://knowledge.workspace.google.com/admin/getting-started/find-your-customer-id) for guidance on how to find this ID.
   5. **Immuta Dataset**: The name of the Google BigQuery dataset to create inside the project. If you are using multiple environments in the same Google BigQuery project, this dataset must be unique across environments.
   6. **Immuta role**: The [custom role you created](#create-a-google-cloud-service-account-and-custom-role).
5. Opt to **Enable Object Sync**, which will keep your connection objects up to date with your Google BigQuery environment.
   1. Select the **Start Time** for when the first object sync job will run each day.
   2. Select the **Run Frequency** to determine how frequently object sync will run each day.
   3. Opt to **Run Object Sync on Create** to create all the data objects for your connection. If you do not select this option, you must run object sync manually or wait for the scheduled object sync for your connection's data objects.
6. Click **Save connection**.

[^1]: Your display name cannot be any of the following words: `data`, `connection`, `object`, `crawl`, `search`, `settings`, `metadata`, `permission`, `sync`, `bulk`, and `upgrade`.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://documentation.immuta.com/SaaS/configuration/integrations/google-bigquery/google-bigquery-viewless-integration/register-a-google-bigquery-connection.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.