> For the complete documentation index, see [llms.txt](https://documentation.immuta.com/saas/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.immuta.com/saas/configuration/integrations/google-bigquery/google-bigquery-viewless-integration.md).
# Google BigQuery Viewless Integration
{% hint style="info" %}
**Public preview**: This integration is available to all accounts that request to enable it for their tenant. Contact your Immuta representative to enable it.
{% endhint %}
{% hint style="info" %}
**Immuta policies will not be automatically enforced in Google BigQuery**
While you can author and apply subscription and data policies on Google BigQuery data sources within Immuta, these policies will not be enforced natively in the Google BigQuery platform.
To use this integration, contact your Immuta representative.
{% endhint %}
The Google BigQuery viewless integration allows you to register data from Google BigQuery in Immuta.
## What does Immuta do in my environment?
### Registering a connection
Google BigQuery is configured and data is registered through [connections](/saas/configuration/integrations/data-and-integrations/registering-a-connection/reference-guides/connections-overview.md), an Immuta feature that allows you to register your data objects through a single connection to make data registration more scalable for your organization. Instead of registering schema and databases individually, you can register them all at once and allow Immuta to monitor your data platform for changes so that data sources are added and removed automatically to reflect the state of data in your data platform.
When the [connection is registered](/saas/configuration/integrations/google-bigquery/google-bigquery-viewless-integration/register-a-google-bigquery-connection.md), Immuta ingests and stores connection metadata in the Immuta metadata database. In the example below, the Immuta application administrator connects the database that contains `marketing-data`, `research-data`, and `cs-data` tables. Immuta registers[^1] these tables as data sources and stores the table metadata in the Immuta metadata database.
Immuta presents a hierarchical view of your data that reflects the hierarchy of objects in Google BigQuery after registration is complete:
* Project
* Dataset
* Data object
Beyond making the registration of your data more intuitive, connections provides more control. Instead of performing operations on individual schemas or tables, you can perform operations (such as object sync) at the connection level.
See the [Connections reference guide](/saas/configuration/integrations/data-and-integrations/registering-a-connection/reference-guides/connections-overview.md) for details about connections and how to manage them. To configure your Google BigQuery viewless integration and register data, see the [Register a Google BigQuery connection guide](/saas/configuration/integrations/google-bigquery/google-bigquery-viewless-integration/register-a-google-bigquery-connection.md).
### Required Google BigQuery privileges
The privileges that the Google BigQuery integration requires align to the least privilege security principle. The table below describes each privilege required by the [setup user](#user-content-fn-2)[^2] and the [service account](#user-content-fn-3)[^3].
| Google BigQuery privilege | User requiring the privilege | Explanation |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------------ |
|
roles/iam.serviceAccountCreator
roles/iam.serviceAccountAdmin
roles/resourcemanager.projectIamAdmin on the project (or be a project owner)
| Setup user | This privilege is required so that the setup user can create the service account and custom role for Immuta. |
|
bigquery.datasets.get
bigquery.tables.get
bigquery.tables.list
| Service account | These privileges allow the Immuta service account to get metadata for datasets and their objects. |
### Maintaining state with Google BigQuery
The following user actions spur various processes in the Google BigQuery viewless integration so that Immuta data remains synchronous with data in Google BigQuery:
* **Data source created or updated**: Immuta registers data source metadata and stores that metadata in the Immuta metadata database.
* **Data source deleted**: Immuta deletes the data source metadata from the metadata database.
## Supported object types
| Object type | Subscription policy support | Data policy support | Request app support |
| ------------------ | --------------------------- | ------------------- | -------------------- |
| Tables | :x: | :x: | :white\_check\_mark: |
| Views | :x: | :x: | :white\_check\_mark: |
| Materialized views | :x: | :x: | :white\_check\_mark: |
## Immuta policies
Immuta will not apply policies in this integration.
## Security and compliance
### Authentication methods
The Google BigQuery viewless integration supports the following authentication method to register a connection:
* **GCP service account key file:** This is the private key file generated when you [create a Google Cloud service account and role for Immuta](/saas/configuration/integrations/google-bigquery/google-bigquery-viewless-integration/register-a-google-bigquery-connection.md#create-a-google-cloud-service-account-and-custom-role) to use to connect to Google BigQuery. These credentials are used by Immuta to register the connection and maintain state between Immuta and Google BigQuery.
## Limitations and known issues
The following Immuta features are unsupported:
* Identification
* Subscription and data policies
* Tag ingestion
* Query audit
[^1]: See the [Connections reference guide](/saas/configuration/integrations/data-and-integrations/registering-a-connection/reference-guides/connections-overview.md#object-sync) for more details about how data objects are synced with Immuta so that the objects stay synchronous with the registered objects in Immuta.
[^2]: The Google BigQuery user registering the connection.
[^3]: This account is used by Immuta to manage the integration once it has been set up.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://documentation.immuta.com/saas/configuration/integrations/google-bigquery/google-bigquery-viewless-integration.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.