Google BigQuery Viewless Integration

Learn about how you can register data from Google BigQuery and govern access to that data

This page describes the recommended workflow for setting up Immuta with Google BigQuery. Following these steps connects your Google BigQuery environment, registers users, ingests metadata, and enables automated governance through global policies and access requests.

Before you begin

To complete this workflow, ensure you have:

• Access to BigQuery Enterprise or Enterprise Plus edition and the permissions required to configure the connection
• An Immuta application administrator who can register the connection

For the recommended implementation described on this page, you should also have:

• An enterprise identity provider
• Identified owners or stewards for your major data domains
• An understanding of the metadata maintained in your external catalog, if you use one

Completing this workflow typically requires coordination among an Immuta application administrator, a Google BigQuery administrator, an identity administrator, governance users, and data stewards.

1

Connect your Google BigQuery environment

1. An application administrator will register the Google BigQuery connection to allow Immuta to discover projects, datasets, and data objects in Google BigQuery. As object sync runs, Immuta creates corresponding data sources that can be governed through policies or access requests.
2. After registering the connection, organize your data into domains. Domains assign ownership of data to the appropriate teams and determine who can manage policies and access workflows for those data sources.

Once your data sources are registered in Immuta and organized into domains, you can apply policy to them.

Start by registering a select Google BigQuery business domain by restricting the permissions of the Immuta service account. Once your implementation is established, you can onboard additional data sources using the same governance model.

2

Register and map your users

1. Connect your organization's identity provider and configure SSO so that users can authenticate with their existing credentials and be automatically registered in Immuta.

   1. If your identity provider supports SCIM, enable provisioning to synchronize users, groups, and attributes. These attributes can then be used when authoring policies so access automatically changes as the user information in the IAM is synced with Immuta.
2. Map Google BigQuery user identities to Immuta users. This ensures that policies written in Immuta are enforced for the correct users when they query data in Google BigQuery.

Once your users are registered and mapped to their Google BigQuery identities, any policies that apply to data sources will be enforced for those users.

If your identity provider supports SCIM, synchronize the user attributes that you plan to reference in policies, such as department, region, or employment type. These attributes provide a strong foundation for reusable global policies.

3

Add metadata to your data

Metadata allows you to author policies that automatically apply across your environment instead of managing individual tables and columns.

If your organization already maintains metadata in an external catalog, connect your external catalog so Immuta continuously synchronizes tags, classifications, and descriptions.

Once your data sources are tagged in Immuta, you can author global policies based on those tags. These policies can apply automatically as additional data sources are registered through object sync and tagged.

4

Configure automated policies

Once users and metadata are available, begin authoring global policies that automatically protect your data.

1. Create subscription policies to automatically grant access to users who meet the required conditions. You can also use subscription policies to enforce organization-wide requirements, such as limiting access to users with specific attributes or training before access can be granted.
2. Create row-level data policies to filter rows based on data metadata.

Author global policies using metadata and user attributes instead of individual Google BigQuery objects or users. This allows the same policies to automatically apply as new data is registered and users are synchronized into Immuta.

5

Configure access requests

Subscription policies can automatically grant access when users meet the required conditions. For access that requires review, configure the Request app, as described below.

1. A governance user will create request forms and attach them to assets so users can request access to Google BigQuery data from their external catalog.
2. If you use an external catalog, configure access request links so users can request access directly from their catalog while continuing to use it as the primary location for data discovery.
3. Data stewards can then review and respond to access requests, and Immuta automatically provisions access when requests are approved.

Once access requests are configured, users can request access from Google BigQuery or your external catalog, and Immuta will route the request for review and provision access when it is approved.

6

Configure audit

After your data, users, and policies are configured, configure audit to export governance activity.

Audit records provide visibility into policy evaluations, access requests, policy changes, and metadata updates, allowing your organization to monitor how data is accessed and governed across your environment.

Next steps

After completing this workflow, your Google BigQuery environment is ready for automated governance. From here you can continue configuring advanced features, refining policies, and onboarding additional Google BigQuery data sources. See the Google BigQuery viewless integration reference guide for architecture details, platform behavior, and additional configuration options.