Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Mengonfigurasi koneksi dengan lampiran jaringan
BigQuery mendukung kueri gabungan yang memungkinkan Anda mengirim pernyataan kueri ke database eksternal dan mendapatkan hasilnya kembali sebagai tabel sementara.
Kueri gabungan menggunakan BigQuery Connection API untuk membuat koneksi. Dokumen ini menunjukkan cara meningkatkan keamanan koneksi ini.
Karena koneksi terhubung langsung ke database Anda, Anda harus mengizinkan
traffic dari Google Cloud ke mesin database Anda. Untuk meningkatkan keamanan, Anda hanya boleh mengizinkan traffic yang berasal dari kueri BigQuery Anda.
Pembatasan traffic ini dapat dilakukan dengan salah satu dari dua cara berikut:
Dengan menentukan alamat IP statis yang digunakan oleh koneksi BigQuery dan menambahkannya ke aturan firewall sumber data eksternal.
Dengan membuat VPN antara BigQuery dan infrastruktur internal Anda, lalu menggunakannya untuk kueri Anda.
Memberikan peran Identity and Access Management (IAM) yang memberi izin yang diperlukan kepada pengguna
untuk melakukan setiap tugas dalam dokumen ini.
Peran yang diperlukan
Untuk mendapatkan izin yang diperlukan untuk mengonfigurasi koneksi dengan lampiran jaringan, minta administrator untuk memberi Anda peran IAM Compute Admin (roles/compute.admin) di project.
Untuk mengetahui informasi selengkapnya tentang cara memberikan peran, lihat Mengelola akses ke project, folder, dan organisasi.
Peran bawaan ini berisi
izin yang diperlukan untuk mengonfigurasi koneksi dengan lampiran jaringan. Untuk melihat izin yang benar-benar diperlukan, luaskan bagian Izin yang diperlukan:
Izin yang diperlukan
Izin berikut diperlukan untuk mengonfigurasi koneksi dengan lampiran jaringan:
Untuk region standar, lampiran jaringan harus berada di region yang sama dengan koneksi. Untuk koneksi di multi-region US, lampiran
jaringan harus berada di region us-central1. Untuk koneksi di multi-region EU, lampiran jaringan harus berada di region europe-west4.
Anda tidak dapat melakukan perubahan pada lampiran jaringan setelah membuatnya. Untuk mengonfigurasi apa pun dengan cara baru, Anda harus membuat ulang lampiran jaringan.
Lampiran jaringan tidak dapat dihapus kecuali jika produsen (BigQuery) menghapus
resource yang dialokasikan. Untuk memulai proses penghapusan, Anda harus menghubungi dukungan BigQuery.
Membuat lampiran jaringan
Saat membuat koneksi untuk federasi kueri, Anda dapat menggunakan parameter lampiran jaringan opsional, yang mengarah ke lampiran jaringan yang menyediakan konektivitas ke jaringan tempat koneksi ke database Anda dibuat. Anda dapat membuat lampiran jaringan dengan menentukan alamat IP statis atau membuat VPN. Untuk kedua opsi, lakukan hal berikut:
Opsional: Bergantung pada kebijakan keamanan organisasi Anda, Anda mungkin perlu mengonfigurasi firewall Google Cloud untuk mengizinkan traffic keluar dengan membuat aturan firewall dengan setelan berikut:
Tetapkan Targets ke All instances in the network.
Tetapkan Destination IPv4 ranges ke seluruh rentang alamat IP.
Tetapkan Specified protocols and ports ke port yang digunakan oleh
database Anda.
Konfigurasi firewall internal Anda untuk mengizinkan ingress dari alamat IP statis yang Anda buat. Proses ini bervariasi menurut sumber data.
Buat koneksi, dan sertakan
nama lampiran jaringan yang Anda buat.
Jalankan kueri gabungan untuk
menyelaraskan project Anda dengan lampiran jaringan.
Koneksi Anda kini dikonfigurasi dengan lampiran jaringan, dan Anda dapat menjalankan kueri gabungan.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-03 UTC."],[[["\u003cp\u003eBigQuery federated queries can connect to external databases, using the BigQuery Connection API to establish this connection.\u003c/p\u003e\n"],["\u003cp\u003eTo enhance connection security, traffic should be restricted to only originate from BigQuery queries, achieved by using either a static IP address or a VPN.\u003c/p\u003e\n"],["\u003cp\u003eNetwork attachments, which can be created with a static IP address or a VPN, are used to define this connectivity to external data sources and are compatible with SAP Datasphere connections.\u003c/p\u003e\n"],["\u003cp\u003eTo configure the connection, after creating a VPC network and subnet, you must also create a network attachment using either a Cloud NAT gateway with a static IP address or a VPN.\u003c/p\u003e\n"],["\u003cp\u003eAfter creating the network attachment, a connection is created which will include the name of this attachment, allowing the project to synchronize using a federated query.\u003c/p\u003e\n"]]],[],null,["# Configure connections with network attachments\n==============================================\n\nBigQuery supports federated queries that let you send a query\nstatement to external databases and get the result back as a temporary table.\nFederated queries use the BigQuery Connection API to establish a connection. This\ndocument shows you how to increase the security of this connection.\n\nBecause the connection connects directly to your database, you must allow\ntraffic from Google Cloud to your database engine. To increase security, you\nshould only allow traffic that comes from your BigQuery queries.\nThis traffic restriction can be accomplished in one of two ways:\n\n- By defining a static IP address that is used by a BigQuery connection and adding it to the firewall rules of the external data source.\n- By creating a VPN between BigQuery and your internal infrastructure, and using it for your queries.\n\nBoth of these techniques are supported through the use of\n[network attachments](/vpc/docs/create-manage-network-attachments).\n\nBefore you begin\n----------------\n\nGrant Identity and Access Management (IAM) roles that give users the necessary permissions\nto perform each task in this document.\n\n### Required roles\n\n\nTo get the permissions that\nyou need to configure a connection with network attachments,\n\nask your administrator to grant you the\n\n\n[Compute Admin](/iam/docs/roles-permissions/compute#compute.admin) (`roles/compute.admin`)\nIAM role on the project.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nThis predefined role contains\n\nthe permissions required to configure a connection with network attachments. To see the exact permissions that are\nrequired, expand the **Required permissions** section:\n\n\n#### Required permissions\n\nThe following permissions are required to configure a connection with network attachments:\n\n- ` compute.networkAttachments.get `\n- ` compute.networkAttachments.update`\n\n\nYou might also be able to get\nthese permissions\nwith [custom roles](/iam/docs/creating-custom-roles) or\nother [predefined roles](/iam/docs/roles-overview#predefined).\n\nFor more information about IAM roles and permissions in\nBigQuery, see\n[BigQuery IAM roles and permissions](/bigquery/docs/access-control).\n\nLimitations\n-----------\n\nConnections with network attachments are subject to the following limitations:\n\n- Network attachments are supported only for [SAP Datasphere connections](/bigquery/docs/sap-datasphere-federated-queries).\n- For standard regions, network attachments must be located in the same region as the connection. For connections in the `US` multi-region, the network attachment must be located in the `us-central1` region. For connections in the `EU` multi-region, the network attachment must be located in the `europe-west4` region.\n- You can't make any changes to your network attachment after you create it. To configure anything in a new way, you need to recreate the network attachment.\n- Network attachments can't be deleted unless the producer (BigQuery) deletes the allocated resources. To initiate the deletion process, you must [contact BigQuery support](/bigquery/docs/support).\n\nCreate a network attachment\n---------------------------\n\nWhen you create a connection for query federation, you can use the optional\nnetwork attachment parameter, which points to a network attachment that provides\nconnectivity to the network from which the connection to your database is\nestablished. You can create a network attachment by either defining a static IP\naddress or creating a VPN. For either option, do the following:\n\n1. If you don't already have one,\n [create a VPC network and subnet](/vpc/docs/create-modify-vpc-networks#create-custom-network).\n\n2. If you want to create a network attachment by defining a static IP address,\n [create a Cloud NAT gateway with a static IP address](/nat/docs/set-up-manage-network-address-translation#create-nat-gateway),\n using the network, region, and subnet that you created. If you want to\n create a network attachment by creating a VPN, create a\n [VPN that is connected to your private network](/network-connectivity/docs/vpn).\n\n3. [Create a network attachment](/vpc/docs/create-manage-network-attachments#create-manual-accept)\n using the network, region, and subnet that you created.\n\n4. Optional: Depending on your organization's security policies, you might need\n to configure your Google Cloud firewall to allow egress by\n [creating a firewall rule](/firewall/docs/using-firewalls#creating_firewall_rules)\n with the following settings:\n\n - Set **Targets** to **All instances in the network**.\n - Set **Destination IPv4 ranges** to the entire IP address range.\n - Set **Specified protocols and ports** to the port that is used by your database.\n5. Configure your internal firewall to allow ingress from the static IP address\n that you created. This process varies by data source.\n\n6. [Create a connection](/bigquery/docs/connections-api-intro), and include the\n name of the network attachment that you created.\n\n7. Run any [federated query](/bigquery/docs/federated-queries-intro) to\n synchronize your project with the network attachment.\n\nYour connection is now configured with a network attachment, and you can run\nfederated queries.\n\nPricing\n-------\n\n- Standard [federated query pricing](/bigquery/docs/federated-queries-intro#pricing) applies.\n- Using VPC is subject to [Virtual Private Cloud pricing](/vpc/pricing).\n- Using Cloud VPN is subject to [Cloud VPN pricing](/network-connectivity/docs/vpn/pricing).\n- Using Cloud NAT is subject to [Cloud NAT pricing](/nat/pricing).\n\nWhat's next\n-----------\n\n- Learn about different [connection types](/bigquery/docs/connections-api-intro).\n- Learn about [managing connections](/bigquery/docs/working-with-connections).\n- Learn about [federated queries](/bigquery/docs/federated-queries-intro)."]]
