Protecting Data in Google BigQuery

Learn how Immuta enforces policies on data in your Google BigQuery environment

In the Google BigQuery integration, Immuta administers Google BigQuery privileges on data registered in Immuta. Then, Immuta users who have been granted access to the tables can query them with policies enforced.

The sequence diagram below outlines the events that occur when an Immuta user who is subscribed to a data source queries it in Google BigQuery.

Registering a connection

The Google BigQuery viewless integration is configured and data is registered through connections, an Immuta feature that allows administrators to register data objects in a technology through a single connection to make data registration more scalable for your organization.

Once the Google BigQuery viewless connection is registered, you can author subscription policies in Immuta to enforce access controls.

See the Google BigQuery viewless integration reference guide for more details about registering a connection.

Protecting data

After objects are registered in Immuta, you can author subscription policies or row-level data policies in Immuta to enforce access controls.

Subscription policies

When a subscription policy is applied to a data source, users who meet the conditions of the policy will be automatically subscribed to the data source. Then, Immuta updates the allow policy on that resource in Google BigQuery to grant users access to that object. For details about how this access is enforced, see the Google BigQuery viewless integration reference guide.

Consider the following example that illustrates how Immuta enforces a subscription policy that only allows users in the analysts group to access the yellow-table. When this policy is authored and applied to the data source, Immuta updates the allow policy on yellow-table to grant access to users (registered in Immuta) that are part of the analysts group.

In the image above, the user in the analysts group accesses yellow-table, while the user who is a part of the research group is denied access.

See the Author a subscription policy page for guidance on applying a subscription policy to a data source. See the Subscription policy access types page for details about the subscription policy types supported and Google BigQuery privileges Immuta grants on objects registered as Immuta data sources.

Data policies

When a row-level data policy is applied to a table, Immuta creates a row-level access policy in Google BigQuery that filters rows that subscribed users are able to see. For details about how row-access policies are enforced, see the Google BigQuery viewless integration reference guide.

In the example below, Immuta creates a Google BigQuery row-level access policy that filters rows based on whether users' groups match values in a specified column:

Only show rows where user is a member of a group that matches the value in columns tagged location.

When the user in the OH group queries yellow-table, which has the location tag applied to the state column, Google BigQuery returns the result with only rows that contain OH in the state column.

See the Data policies page for guidance on authoring data policies in Immuta and the supported data policies for the Google BigQuery viewless integration.