Organiza tus páginas con colecciones
Guarda y categoriza el contenido según tus preferencias.
Roles y permisos de IAM para BigQuery
En este documento, se proporciona una lista de los roles y permisos predefinidos de Identity and Access Management (IAM) para BigQuery. En esta página, se incluyen los roles y permisos para lo siguiente:
BigQuery: Roles y permisos que se aplican a los recursos de BigQuery, como conjuntos de datos, tablas, vistas y rutinas. Muchos de estos roles y permisos también se pueden otorgar a recursos de Resource Manager, como proyectos, carpetas y organizaciones.
API de BigQuery Connection: Es el rol que otorga acceso de agente de servicio a una conexión de Cloud SQL.
Consulta continua de BigQuery: Es el rol que otorga a una cuenta de servicio acceso a una consulta continua.
Política de datos de BigQuery: Roles y permisos que se aplican a las políticas de datos en BigQuery.
Servicio de transferencia de datos de BigQuery: Es el rol que otorga a un agente de servicio acceso para crear trabajos que transfieran datos.
BigQuery Engine para Apache Flink: Roles y permisos que se aplican a los recursos de BigQuery Engine para Apache Flink
API del Servicio de migración de BigQuery: Roles y permisos que se aplican a los recursos del Servicio de migración de BigQuery.
BigQuery Omni: Es el rol que otorga a un agente de servicio acceso a las tablas.
Uso compartido de BigQuery: Roles y permisos que se aplican a los recursos de uso compartido de BigQuery
Funciones predefinidas de IAM de BigQuery
En las siguientes tablas, se enumeran los roles predefinidos de IAM de BigQuery con una lista correspondiente de todos los permisos que se incluyen en cada rol. Ten en cuenta que cada permiso es aplicable a un tipo de recurso específico.
Funciones de BigQuery
En esta tabla, se enumeran los roles y permisos de IAM para BigQuery. Para buscar todos los roles y permisos, consulta el índice de roles y permisos.
Role
Permissions
BigQuery Admin
(roles/bigquery.admin)
Provides permissions to manage all resources within the project. Can manage
all data within the project, and can cancel jobs from other users running
within the project.
Lowest-level resources where you can grant this role:
Dataset
These resources within a dataset:
Table
View
Routine
Connection
Saved query
Data canvas
Pipeline
Data preparation
Repository
This role can also be granted on Resource Manager resources (projects, folders, and
organizations).
Lowest-level resources where you can grant this role:
Connection
This role can also be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.connections.*
bigquery.connections.create
bigquery.connections.delegate
bigquery.connections.delete
bigquery.connections.get
bigquery.connections.getIamPolicy
bigquery.connections.list
bigquery.connections.setIamPolicy
bigquery.connections.update
bigquery.connections.updateTag
bigquery.connections.use
BigQuery Connection User
(roles/bigquery.connectionUser)
Lowest-level resources where you can grant this role:
Connection
This role can also be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.connections.get
bigquery.connections.getIamPolicy
bigquery.connections.list
bigquery.connections.use
BigQuery Data Editor
(roles/bigquery.dataEditor)
When granted on a table or view, this role provides permissions to:
Read and update data and metadata for the table or view.
Delete the table or view.
This role cannot be granted to individual models.
When granted on a dataset, this role provides permissions to:
Read the dataset's metadata and list tables in the dataset.
Create, update, get, and delete the dataset's tables.
The BigQuery Data Editor role is mapped to the
WRITER
BigQuery basic role. When you grant the BigQuery Data Editor role to a principal at
the dataset level, the principal is granted WRITER access to the dataset.
When applied at the project or organization level, this role also lets users
create new datasets.
Lowest-level resources where you can grant this role:
Dataset
These resources within a dataset:
Table
View
Routine
This role can also be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.config.get
bigquery.datasets.create
bigquery.datasets.get
bigquery.datasets.getIamPolicy
bigquery.datasets.updateTag
bigquery.models.*
bigquery.models.create
bigquery.models.delete
bigquery.models.export
bigquery.models.getData
bigquery.models.getMetadata
bigquery.models.list
bigquery.models.updateData
bigquery.models.updateMetadata
bigquery.models.updateTag
bigquery.routines.*
bigquery.routines.create
bigquery.routines.delete
bigquery.routines.get
bigquery.routines.list
bigquery.routines.update
bigquery.routines.updateTag
bigquery.tables.create
bigquery.tables.createIndex
bigquery.tables.createSnapshot
bigquery.tables.delete
bigquery.tables.deleteIndex
bigquery.tables.export
bigquery.tables.get
bigquery.tables.getData
bigquery.tables.getIamPolicy
bigquery.tables.list
bigquery.tables.replicateData
bigquery.tables.restoreSnapshot
bigquery.tables.update
bigquery.tables.updateData
bigquery.tables.updateIndex
bigquery.tables.updateTag
cloudkms.keyHandles.*
cloudkms.keyHandles.create
cloudkms.keyHandles.get
cloudkms.keyHandles.list
cloudkms.operations.get
cloudkms.projects.showEffectiveAutokeyConfig
dataplex.datascans.create
dataplex.datascans.delete
dataplex.datascans.get
dataplex.datascans.getData
dataplex.datascans.getIamPolicy
dataplex.datascans.list
dataplex.datascans.run
dataplex.datascans.update
dataplex.operations.get
dataplex.operations.list
resourcemanager.projects.get
resourcemanager.projects.list
BigQuery Data Owner
(roles/bigquery.dataOwner)
When granted on a table or view, this role provides permissions to:
Read and update data and metadata for the table or view.
Share the table or view.
Delete the table or view.
This role cannot be granted to individual models.
When granted on a dataset, this role provides permissions to:
Read, update, and delete the dataset.
Create, update, get, and delete the dataset's tables.
The BigQuery Data Owner role is mapped to the
OWNER
BigQuery basic role. When you grant the BigQuery Data Owner role to a principal at
the dataset level, the principal is granted OWNER access to the dataset.
When applied at the project or organization level, this role can also
create new datasets.
Lowest-level resources where you can grant this role:
Dataset
These resources within a dataset:
Table
View
Routine
This role can also be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.config.get
bigquery.dataPolicies.create
bigquery.dataPolicies.delete
bigquery.dataPolicies.get
bigquery.dataPolicies.getIamPolicy
bigquery.dataPolicies.list
bigquery.dataPolicies.setIamPolicy
bigquery.dataPolicies.update
bigquery.datasets.*
bigquery.datasets.create
bigquery.datasets.createTagBinding
bigquery.datasets.delete
bigquery.datasets.deleteTagBinding
bigquery.datasets.get
bigquery.datasets.getIamPolicy
bigquery.datasets.link
bigquery.datasets.listEffectiveTags
bigquery.datasets.listSharedDatasetUsage
bigquery.datasets.listTagBindings
bigquery.datasets.setIamPolicy
bigquery.datasets.update
bigquery.datasets.updateTag
bigquery.models.*
bigquery.models.create
bigquery.models.delete
bigquery.models.export
bigquery.models.getData
bigquery.models.getMetadata
bigquery.models.list
bigquery.models.updateData
bigquery.models.updateMetadata
bigquery.models.updateTag
bigquery.routines.*
bigquery.routines.create
bigquery.routines.delete
bigquery.routines.get
bigquery.routines.list
bigquery.routines.update
bigquery.routines.updateTag
bigquery.rowAccessPolicies.create
bigquery.rowAccessPolicies.delete
bigquery.rowAccessPolicies.get
bigquery.rowAccessPolicies.getIamPolicy
bigquery.rowAccessPolicies.list
bigquery.rowAccessPolicies.setIamPolicy
bigquery.rowAccessPolicies.update
bigquery.tables.*
bigquery.tables.create
bigquery.tables.createIndex
bigquery.tables.createSnapshot
bigquery.tables.createTagBinding
bigquery.tables.delete
bigquery.tables.deleteIndex
bigquery.tables.deleteSnapshot
bigquery.tables.deleteTagBinding
bigquery.tables.export
bigquery.tables.get
bigquery.tables.getData
bigquery.tables.getIamPolicy
bigquery.tables.list
bigquery.tables.listEffectiveTags
bigquery.tables.listTagBindings
bigquery.tables.replicateData
bigquery.tables.restoreSnapshot
bigquery.tables.setCategory
bigquery.tables.setColumnDataPolicy
bigquery.tables.setIamPolicy
bigquery.tables.update
bigquery.tables.updateData
bigquery.tables.updateIndex
bigquery.tables.updateTag
cloudkms.keyHandles.*
cloudkms.keyHandles.create
cloudkms.keyHandles.get
cloudkms.keyHandles.list
cloudkms.operations.get
cloudkms.projects.showEffectiveAutokeyConfig
dataplex.datascans.*
dataplex.datascans.create
dataplex.datascans.delete
dataplex.datascans.get
dataplex.datascans.getData
dataplex.datascans.getIamPolicy
dataplex.datascans.list
dataplex.datascans.run
dataplex.datascans.setIamPolicy
dataplex.datascans.update
dataplex.operations.get
dataplex.operations.list
resourcemanager.projects.get
resourcemanager.projects.list
BigQuery Data Viewer
(roles/bigquery.dataViewer)
When granted on a table or view, this role provides permissions to:
Read data and metadata from the table or view.
This role cannot be granted to individual models.
When granted on a dataset, this role provides permissions to list all of the resources in the
dataset (such as tables, views, snapshots, models, and routines) and to read their data and metadata
with applicable APIs and in queries.
The BigQuery Data Viewer role is mapped to the
READER
BigQuery basic role. When you grant the BigQuery Data Viewer role to a principal at
the dataset level, the principal is granted READER access to the dataset.
When applied at the project or organization level, this role can also
enumerate all datasets in the project. Additional roles, however, are
necessary to allow the running of jobs.
Lowest-level resources where you can grant this role:
Dataset
These resources within a dataset:
Table
View
Routine
This role can also be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.datasets.get
bigquery.datasets.getIamPolicy
bigquery.models.export
bigquery.models.getData
bigquery.models.getMetadata
bigquery.models.list
bigquery.routines.get
bigquery.routines.list
bigquery.tables.createSnapshot
bigquery.tables.export
bigquery.tables.get
bigquery.tables.getData
bigquery.tables.getIamPolicy
bigquery.tables.list
bigquery.tables.replicateData
dataplex.datascans.get
dataplex.datascans.getData
dataplex.datascans.getIamPolicy
dataplex.datascans.list
resourcemanager.projects.get
resourcemanager.projects.list
BigQuery Filtered Data Viewer
(roles/bigquery.filteredDataViewer)
Access to view filtered table data defined by a row access policy.
bigquery.filteredDataViewer is a system-managed role. Grant the role by using
row-level access policies. Don't apply the role directly to a resource through
Identity and Access Management (IAM).
bigquery.rowAccessPolicies.getFilteredData
BigQuery Job User
(roles/bigquery.jobUser)
Provides permissions to run jobs, including queries, within the project.
This role can only be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.config.get
bigquery.jobs.create
dataform.locations.*
dataform.locations.get
dataform.locations.list
dataform.repositories.create
dataform.repositories.list
resourcemanager.projects.get
resourcemanager.projects.list
BigQuery Metadata Viewer
(roles/bigquery.metadataViewer)
When granted on a table or view, this role provides permissions to:
Read metadata from the table or view.
This role cannot be granted to individual models.
When granted on a dataset, this role provides permissions to:
List tables and views in the dataset.
Read metadata from the dataset's tables and views.
When applied at the project or organization level, this role provides permissions to:
List all datasets and read metadata for all datasets in the project.
List all tables and views and read metadata for all tables and views
in the project.
Additional roles are necessary to allow the running of jobs.
Lowest-level resources where you can grant this role:
Dataset
These resources within a dataset:
Table
View
Routine
This role can also be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.datasets.get
bigquery.datasets.getIamPolicy
bigquery.models.getMetadata
bigquery.models.list
bigquery.routines.get
bigquery.routines.list
bigquery.tables.get
bigquery.tables.getIamPolicy
bigquery.tables.list
dataplex.projects.search
resourcemanager.projects.get
resourcemanager.projects.list
BigQuery ObjectRef Admin
(roles/bigquery.objectRefAdmin)
Administer ObjectRef resources that includes read and write permissions
Lowest-level resources where you can grant this role:
Connection
This role can also be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.objectRefs.*
bigquery.objectRefs.read
bigquery.objectRefs.write
BigQuery ObjectRef Reader
(roles/bigquery.objectRefReader)
Role for reading referenced objects via ObjectRefs in BigQuery
Lowest-level resources where you can grant this role:
Connection
This role can also be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.objectRefs.read
BigQuery Read Session User
(roles/bigquery.readSessionUser)
Provides the ability to create and use read sessions.
This role can only be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.readsessions.*
bigquery.readsessions.create
bigquery.readsessions.getData
bigquery.readsessions.update
resourcemanager.projects.get
resourcemanager.projects.list
BigQuery Resource Admin
(roles/bigquery.resourceAdmin)
Administers BigQuery workloads, including slot assignments, commitments, and reservations.
This role can only be granted on Resource Manager resources (projects, folders, and
organizations).
When granted on a dataset, this role provides the ability to read the dataset's metadata and list
tables in the dataset.
When granted on a project, this role also provides the ability to run jobs, including queries,
within the project. A principal with this role can enumerate their own jobs, cancel their own jobs, and
enumerate datasets within a project. Additionally, allows the creation of new datasets within the
project; the creator is granted the BigQuery Data Owner role (roles/bigquery.dataOwner)
on these new datasets.
Lowest-level resources where you can grant this role:
Dataset
These resources within a dataset:
Routine
This role can also be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.bireservations.get
bigquery.capacityCommitments.get
bigquery.capacityCommitments.list
bigquery.config.get
bigquery.datasets.create
bigquery.datasets.get
bigquery.datasets.getIamPolicy
bigquery.jobs.create
bigquery.jobs.list
bigquery.models.list
bigquery.readsessions.*
bigquery.readsessions.create
bigquery.readsessions.getData
bigquery.readsessions.update
bigquery.reservationAssignments.list
bigquery.reservationAssignments.search
bigquery.reservations.get
bigquery.reservations.list
bigquery.reservations.listFailoverDatasets
bigquery.reservations.use
bigquery.routines.list
bigquery.savedqueries.get
bigquery.savedqueries.list
bigquery.tables.list
bigquery.transfers.get
bigquerymigration.translation.translate
cloudkms.keyHandles.*
cloudkms.keyHandles.create
cloudkms.keyHandles.get
cloudkms.keyHandles.list
cloudkms.operations.get
cloudkms.projects.showEffectiveAutokeyConfig
dataform.locations.*
dataform.locations.get
dataform.locations.list
dataform.repositories.create
dataform.repositories.list
dataplex.projects.search
resourcemanager.projects.get
resourcemanager.projects.list
Roles de la API de BigQuery Connection
En esta tabla, se enumeran los roles y permisos de IAM para la API de BigQuery Connection. Para buscar todos los roles y permisos, consulta el índice de roles y permisos.
Role
Permissions
BigQuery Connection Service Agent
(roles/bigqueryconnection.serviceAgent)
Gives BigQuery Connection Service access to Cloud SQL instances in user projects.
cloudsql.instances.connect
cloudsql.instances.get
logging.logEntries.create
logging.logEntries.route
monitoring.metricDescriptors.create
monitoring.metricDescriptors.get
monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.*
monitoring.monitoredResourceDescriptors.get
monitoring.monitoredResourceDescriptors.list
monitoring.timeSeries.create
Roles de BigQuery Continuous Query
En esta tabla, se enumeran los roles y permisos de IAM para la consulta continua de BigQuery. Para buscar todos los roles y permisos, consulta el índice de roles y permisos.
Role
Permissions
BigQuery Continuous Query Service Agent
(roles/bigquerycontinuousquery.serviceAgent)
Gives BigQuery Continuous Query access to the service accounts in the user project.
iam.serviceAccounts.getAccessToken
Roles de BigQuery Data Policy
En esta tabla, se enumeran los roles y permisos de IAM para la política de datos de BigQuery. Para buscar todos los roles y permisos, consulta el índice de roles y permisos.
Role
Permissions
BigQuery Data Policy Admin
(roles/bigquerydatapolicy.admin)
Role for managing Data Policies in BigQuery
This role can only be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.dataPolicies.create
bigquery.dataPolicies.delete
bigquery.dataPolicies.get
bigquery.dataPolicies.getIamPolicy
bigquery.dataPolicies.list
bigquery.dataPolicies.setIamPolicy
bigquery.dataPolicies.update
Masked Reader
(roles/bigquerydatapolicy.maskedReader)
Masked read access to sub-resources tagged by the policy tag associated with a data policy, for
example, BigQuery columns
This role can only be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.dataPolicies.maskedGet
Raw Data Reader
Beta
(roles/bigquerydatapolicy.rawDataReader)
Raw read access to sub-resources associated with a data policy, for example, BigQuery columns
This role can only be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.dataPolicies.getRawData
BigQuery Data Policy Viewer
(roles/bigquerydatapolicy.viewer)
Role for viewing Data Policies in BigQuery
This role can only be granted on Resource Manager resources (projects, folders, and
organizations).
bigquery.dataPolicies.get
bigquery.dataPolicies.list
Roles del Servicio de transferencia de datos de BigQuery
En esta tabla, se enumeran los roles y permisos de IAM para el Servicio de transferencia de datos de BigQuery. Para buscar todos los roles y permisos, consulta el índice de roles y permisos.
Role
Permissions
BigQuery Data Transfer Service Agent
(roles/bigquerydatatransfer.serviceAgent)
Gives BigQuery Data Transfer Service access to start BigQuery jobs in consumer project.
bigquery.config.get
bigquery.jobs.create
compute.networkAttachments.get
compute.networkAttachments.update
compute.regionOperations.get
compute.subnetworks.use
dataform.locations.*
dataform.locations.get
dataform.locations.list
dataform.repositories.create
dataform.repositories.list
iam.serviceAccounts.getAccessToken
logging.logEntries.create
logging.logEntries.route
resourcemanager.projects.get
resourcemanager.projects.list
serviceusage.services.use
Roles de BigQuery Engine para Apache Flink
En esta tabla, se enumeran los roles y permisos de IAM para BigQuery Engine para Apache Flink. Para buscar todos los roles y permisos, consulta el índice de roles y permisos.
Role
Permissions
Managed Flink Admin
Beta
(roles/managedflink.admin)
Full access to Managed Flink resources.
managedflink.*
managedflink.deployments.create
managedflink.deployments.delete
managedflink.deployments.get
managedflink.deployments.list
managedflink.deployments.update
managedflink.jobs.create
managedflink.jobs.delete
managedflink.jobs.get
managedflink.jobs.list
managedflink.jobs.update
managedflink.locations.get
managedflink.locations.list
managedflink.operations.cancel
managedflink.operations.delete
managedflink.operations.get
managedflink.operations.list
managedflink.sessions.create
managedflink.sessions.delete
managedflink.sessions.get
managedflink.sessions.list
managedflink.sessions.update
resourcemanager.projects.get
resourcemanager.projects.list
Managed Flink Developer
Beta
(roles/managedflink.developer)
Full access to Managed Flink Jobs and Sessions and read access to Deployments.
managedflink.deployments.get
managedflink.deployments.list
managedflink.jobs.*
managedflink.jobs.create
managedflink.jobs.delete
managedflink.jobs.get
managedflink.jobs.list
managedflink.jobs.update
managedflink.locations.*
managedflink.locations.get
managedflink.locations.list
managedflink.operations.get
managedflink.operations.list
managedflink.sessions.*
managedflink.sessions.create
managedflink.sessions.delete
managedflink.sessions.get
managedflink.sessions.list
managedflink.sessions.update
resourcemanager.projects.get
resourcemanager.projects.list
Managed Flink Service Agent
(roles/managedflink.serviceAgent)
Gives Managed Flink Service Agent access to Cloud Platform resources.
compute.networkAttachments.create
compute.networkAttachments.delete
compute.networkAttachments.get
compute.networkAttachments.list
compute.networkAttachments.update
compute.networks.get
compute.networks.list
compute.regionOperations.get
compute.subnetworks.get
compute.subnetworks.list
compute.subnetworks.use
dns.networks.targetWithPeeringZone
managedkafka.clusters.get
managedkafka.clusters.list
managedkafka.clusters.update
monitoring.metricDescriptors.create
monitoring.metricDescriptors.get
monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.*
monitoring.monitoredResourceDescriptors.get
monitoring.monitoredResourceDescriptors.list
monitoring.timeSeries.create
serviceusage.services.use
storage.objects.get
Managed Flink Viewer
Beta
(roles/managedflink.viewer)
Readonly access to Managed Flink resources.
managedflink.deployments.get
managedflink.deployments.list
managedflink.jobs.get
managedflink.jobs.list
managedflink.locations.*
managedflink.locations.get
managedflink.locations.list
managedflink.operations.get
managedflink.operations.list
managedflink.sessions.get
managedflink.sessions.list
resourcemanager.projects.get
resourcemanager.projects.list
Roles del Servicio de migración de BigQuery
En esta tabla, se enumeran los roles y permisos de IAM para el Servicio de migración de BigQuery. Para buscar todos los roles y permisos, consulta el índice de roles y permisos.
User of EDW migration interactive SQL translation service.
bigquerymigration.translation.translate
MigrationWorkflow Viewer
(roles/bigquerymigration.viewer)
Viewer of EDW migration MigrationWorkflow.
bigquerymigration.subtasks.*
bigquerymigration.subtasks.get
bigquerymigration.subtasks.list
bigquerymigration.workflows.get
bigquerymigration.workflows.list
Task Worker
(roles/bigquerymigration.worker)
Worker that executes EDW migration subtasks.
storage.objects.create
storage.objects.get
storage.objects.list
Roles de BigQuery Omni
En esta tabla, se enumeran los roles y permisos de IAM para BigQuery Omni. Para buscar todos los roles y permisos, consulta el índice de roles y permisos.
Role
Permissions
BigQuery Omni Service Agent
(roles/bigqueryomni.serviceAgent)
Gives BigQuery Omni access to tables in user projects.
bigquery.jobs.create
bigquery.tables.updateData
Roles de uso compartido de BigQuery
En esta tabla, se enumeran los roles y permisos de IAM para el uso compartido de BigQuery. Para buscar todos los roles y permisos, consulta el índice de roles y permisos.
Role
Permissions
Analytics Hub Admin
(roles/analyticshub.admin)
Administer Data Exchanges and Listings
analyticshub.dataExchanges.create
analyticshub.dataExchanges.delete
analyticshub.dataExchanges.get
analyticshub.dataExchanges.getIamPolicy
analyticshub.dataExchanges.list
analyticshub.dataExchanges.setIamPolicy
analyticshub.dataExchanges.update
analyticshub.dataExchanges.viewSubscriptions
analyticshub.listings.create
analyticshub.listings.delete
analyticshub.listings.get
analyticshub.listings.getIamPolicy
analyticshub.listings.list
analyticshub.listings.setIamPolicy
analyticshub.listings.update
analyticshub.listings.viewSubscriptions
analyticshub.subscriptions.*
analyticshub.subscriptions.create
analyticshub.subscriptions.delete
analyticshub.subscriptions.get
analyticshub.subscriptions.list
analyticshub.subscriptions.update
resourcemanager.projects.get
resourcemanager.projects.list
Analytics Hub Listing Admin
(roles/analyticshub.listingAdmin)
Grants full control over the Listing, including updating, deleting and setting ACLs
analyticshub.dataExchanges.get
analyticshub.dataExchanges.getIamPolicy
analyticshub.dataExchanges.list
analyticshub.listings.delete
analyticshub.listings.get
analyticshub.listings.getIamPolicy
analyticshub.listings.list
analyticshub.listings.setIamPolicy
analyticshub.listings.update
analyticshub.listings.viewSubscriptions
resourcemanager.projects.get
resourcemanager.projects.list
Analytics Hub Publisher
(roles/analyticshub.publisher)
Can publish to Data Exchanges thus creating Listings
analyticshub.dataExchanges.get
analyticshub.dataExchanges.getIamPolicy
analyticshub.dataExchanges.list
analyticshub.listings.create
analyticshub.listings.get
analyticshub.listings.getIamPolicy
analyticshub.listings.list
resourcemanager.projects.get
resourcemanager.projects.list
Analytics Hub Subscriber
(roles/analyticshub.subscriber)
Can browse Data Exchanges and subscribe to Listings
analyticshub.dataExchanges.get
analyticshub.dataExchanges.getIamPolicy
analyticshub.dataExchanges.list
analyticshub.dataExchanges.subscribe
analyticshub.listings.get
analyticshub.listings.getIamPolicy
analyticshub.listings.list
analyticshub.listings.subscribe
resourcemanager.projects.get
resourcemanager.projects.list
Analytics Hub Subscription Owner
(roles/analyticshub.subscriptionOwner)
Grants full control over the Subscription, including updating and deleting
analyticshub.dataExchanges.get
analyticshub.dataExchanges.getIamPolicy
analyticshub.dataExchanges.list
analyticshub.listings.get
analyticshub.listings.getIamPolicy
analyticshub.listings.list
analyticshub.subscriptions.*
analyticshub.subscriptions.create
analyticshub.subscriptions.delete
analyticshub.subscriptions.get
analyticshub.subscriptions.list
analyticshub.subscriptions.update
resourcemanager.projects.get
resourcemanager.projects.list
Analytics Hub Viewer
(roles/analyticshub.viewer)
Can browse Data Exchanges and Listings
analyticshub.dataExchanges.get
analyticshub.dataExchanges.getIamPolicy
analyticshub.dataExchanges.list
analyticshub.listings.get
analyticshub.listings.getIamPolicy
analyticshub.listings.list
resourcemanager.projects.get
resourcemanager.projects.list
Permisos de BigQuery
En las siguientes tablas, se enumeran los permisos disponibles en BigQuery. Estos están incluidos en roles predefinidos y pueden usarse en las definiciones de roles personalizados. Para buscar todos los roles y permisos, consulta el índice de roles y permisos.
Permisos de BigQuery
En esta tabla, se enumeran los permisos de IAM para BigQuery y los roles que los incluyen. Para buscar todos los roles y permisos, consulta el índice de roles y permisos.
Permisos del Servicio de transferencia de datos de BigQuery
No hay permisos de IAM para este servicio.
Permisos de BigQuery Engine para Apache Flink
En esta tabla, se enumeran los permisos de IAM para BigQuery Engine para Apache Flink y los roles que los incluyen. Para buscar todos los roles y permisos, consulta el índice de roles y permisos.
En esta tabla, se enumeran los permisos de IAM para el Servicio de migración de BigQuery y los roles que los incluyen. Para buscar todos los roles y permisos, consulta el índice de roles y permisos.
En esta tabla, se enumeran los permisos de IAM para el uso compartido de BigQuery y los roles que los incluyen. Para buscar todos los roles y permisos, consulta el índice de roles y permisos.
Borrar un modelo mediante la declaración DROP MODEL
bigquery.models.getMetadata
Obtiene metadatos del modelo mediante la API models.get
bigquery.models.list
Enumera modelos y los metadatos en estos mediante la API models.list
bigquery.models.updateMetadata
Actualiza los metadatos del modelo mediante la API models.delete. Si configuras o actualizas un tiempo de vencimiento distinto de cero para el modelo, también se necesita el permiso bigquery.models.delete
bigquery.jobs.create bigquery.models.getData
Realiza evaluaciones, predicciones e inspecciones de modelos y características mediante funciones como ML.EVALUATE, ML.PREDICT, ML.TRAINING_INFO y ML.WEIGHTS.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-07-14 (UTC)"],[[["IAM provides granular access control for BigQuery resources, ensuring that principals have only the permissions needed to perform their tasks."],["BigQuery permissions are granted via IAM roles, which can be predefined by Google Cloud or customized by users, and roles are applied at various levels such as organizations, projects, datasets, and individual resources like tables or views."],["Predefined BigQuery IAM roles like BigQuery Job User, BigQuery Metadata Viewer, and BigQuery Resource Admin provide different levels of access to BigQuery resources and operations."],["Specific permissions within BigQuery, such as creating datasets (`bigquery.datasets.create`) or running jobs (`bigquery.jobs.create`), can be combined to create custom IAM roles, offering more fine-grained control over resource access."],["Roles like the BigQuery Data Policy Admin, Masked Reader, Raw Data Reader, and BigQuery Data Policy Viewer are used to manage data policies, offering the ability to restrict access to certain data as well as allow access to different levels of data."]]],[]]
