Google Associate Cloud Engineer Question 338
Single answerGoogle Cloud PlatformYou are tasked with granting a team of data analysts the ability to view BigQuery datasets but not modify them. Which IAM policy binding should you create in Google Cloud Platform?
- A
Assign the 'roles/bigquery.dataEditor' role to the team.
- B
Assign the 'roles/bigquery.dataViewer' role to the team.
- C
Assign the 'roles/viewer' role to the team.
- D
Assign the 'roles/bigquery.user' role to the team.
Show answer and explanation
Correct answer: B
Explanation
When you need to grant read-only access to BigQuery datasets, the 'roles/bigquery.dataViewer' role is appropriate as it allows users to view datasets without modifying them. This role aligns perfectly with the requirement of allowing data analysts to view but not alter the datasets.
- A. Incorrect.
The 'roles/bigquery.dataEditor' role allows editing datasets, which is more permission than needed.
- B. Correct.
The 'roles/bigquery.dataViewer' role provides read-only access to BigQuery datasets, which is exactly what is required.
- C. Incorrect.
The 'roles/viewer' role grants read access to all resources in the project, not just BigQuery datasets.
- D. Incorrect.
The 'roles/bigquery.user' role primarily allows users to run jobs, which does not specifically grant viewing access to datasets.