Use IAM custom roles to manage access to your BigQuery data warehouse

When migrating a data warehouse to BigQuery, one of the most critical tasks is mapping existing user www.mcafee.com/activate product key permissions to equivalent Google cloud management and access quality permissions and roles www.mcafee/activate. This is especially mcafee.com/activate product key true for migrating from large enterprise data warehouses like Teradata to Big query. The existing Teradata databases commonly contain www.mcafee.com/activate multiple user-defined roles that combine access permissions and capture common data access www.mcafee.com/activate download patterns. Mapping those Teradata roles to predefined or custom BigQuery IAM roles requires a deeper understanding of your organization's common data access patterns.

Based on our experiences helping customers migrate to BigQuery, we’ve identified some common mcafee.com/activate product key data access patterns that our customers define as roles in their Teradata environments. In this post www.mcafee.com/activate product key, you’ll learn how to map those common Teradata user-defined roles to BigQuery IAM custom roles. Those roles may be helpful not only to users who migrate from Teradata but also to any data admins who manage data warehouses on BigQuery. Understanding this concept www.mcafee.com/activate ahead of your www.mcafee/activate migration can help save time and ensure that your users and data are protected throughout the process.

Teradata access rights codes and user-defined roles

In Teradata, Access right codes www.mcafee.com/activate download describe the user access privilege on a particular database, table, or column. There are some common access rights codes combinations that describe common actions that a user can perform on Teradata objects. For example, one user may only read and modify metadata, another user may read the data, and yet another user may read and modify that data.  

Note that to build views www.mcafee.com/activate product key or stored procedures in both Teradata and BigQuery, a user should have access to objects that are referenced www.mcafee/activate in those views or procedures in addition to the schema editor or developer role. 

Cloud IAM equivalent permissions

Our Cloud IAM controls are used by some of our most security-conscious customers, and you can map many of the concepts you’re www.mcafee.com/activate used to in Teradata into Google Cloud. You can grant permissions to access BigQuery by granting roles to a user, a group, or a service account mcafee.com/activate product key. There are three types of roles in Cloud IAM:

• Predefined roles are managed by Google Cloud and meant to support common use cases.
• Custom roles are a user-specified list of permissions. You’ll leverage them to map BigQuery IAM to Teradata user-defined roles.
• Primitive roles existed prior to the introduction www.mcafee.com/activate download of Cloud IAM.

• Create and assign Cloud IAM roles

  Your next step is to create corresponding Cloud IAM custom roles with the privileges listed above. The fastest way to assign mcafee.com/activate product key multiple permissions www.mcafee/activate to a role is to use gcloud command, as described the direction

  

  In Google Cloud, you can create  a custom www.mcafee.com/activate product key role on a project or organization level. If you decide to create www.mcafee.com/activate download a role on the organization level, consider adding resourcemanager.projects.get and resourcemanager.projects.list permissions to the schema reader and schema editor roles. Those additional permissions authorize a user to see information about projects in your organization www.mcafee/activate, which fosters openness and transparency in the cloud environment.

  After you define the custom roles, the next step is to bind those roles to a Google group (groups offer a convenient method of assigning roles to users). These bindings of roles to groups mcafee.com/activate product key form a policy, and you www.mcafee.com/activate can attach this policy to Google cloud resource at any level of your entire organization’s resource hierarchy (shown in the image below). Attaching policies www.mcafee.com/activate product key  www.mcafee.com/activate download in this way provides optimal www.mcafee/activate resource sharing by limiting the need to duplicate data as a means for sharing data.