Connector guide
Connect BigQuery safely
Dataset-scoped Google Cloud access for organization administrators
1. Create a dedicated workload identity
Use a dedicated service account or workload-identity federation principal. Grant BigQuery Job User at the execution project and BigQuery Data Viewer only on approved datasets or authorized views. Do not grant Owner, Editor, BigQuery Admin, Data Editor, or broad project-level Data Viewer access.
2. Restrict network and authentication
- Prefer workload-identity federation or short-lived credentials instead of downloaded service-account keys.
- If a key is unavoidable, store it only in Maya’s encrypted credential boundary and rotate it frequently.
- Apply organization policies, VPC Service Controls, and restricted APIs where your environment supports them.
- Use a dedicated billing or execution project with query quotas and cost controls.
3. Expose only approved data
- Prefer authorized views or policy-tagged columns over granting entire raw datasets.
- Use row-level security and dynamic data masking for tenant, financial, health, or identity data.
- Allowlist exact project and dataset IDs in Maya.
- Set maximum bytes billed and deterministic result limits for every query.
4. Verify before connecting
- The principal can create query jobs and read approved views but cannot modify datasets or tables.
- No unrelated datasets are visible through inherited project roles.
- Query quotas, maximum bytes billed, and audit logging are enabled.
- Keys, SQL text, and returned sensitive values are excluded from general telemetry.
5. Rotate and revoke
Rotate secrets or keys on a defined schedule and immediately after suspected exposure. Disconnect the integration in Maya before disabling the external identity, and retain only non-sensitive audit metadata.