Create and manage authorized views

Console

1. Open the list of Bigtable instances in the Google Cloud console.

   Open the instance list

2. Click the instance that contains the table that you want an authorized view of.

3. In the navigation pane, click Bigtable Studio.

4. Click Builder to open the query builder.

5. Choose the table that you want an authorized view of.

6. Add clauses to build a query that returns only data that you want the authorized view users to have access to.

   • Acceptable clauses for an authorized view are row key prefix and columns (column qualifiers).
   • To specify a column qualifier prefix, add an asterisk after the prefix. For example, to include all columns that start with "data", enter data* in the Columns field after the column family name.
   • The Limit clause is ignored when the authorized view is saved.
   • For more information on using the query builder, see Build queries in the console.

7. Click Run.

8. After you've verified that the results pane shows data that should be included in the authorized view, click Save as view.

9. Enter a permanent identifier for the authorized view that is not already in use for the table.

10. Optional: To save without granting access, click Save.

11. Optional: To save the authorized view and then configure access for it, click Save & grant access. For more information about access control, see Bigtable access control with IAM.

    1. Add at least one principal and select the role to which that principal or group of principals should be assigned.
    2. Optional: To grant access for additional roles, click Add another role and then enter the principal and role for each additional role.
    3. Click Save.

gcloud

Run the bigtable authorized-views create command. For more information, see the reference documentation at gcloud bigtable authorized-views create.

gcloud bigtable authorized-views create AUTHORIZED_VIEW_ID \
  --instance=INSTANCE_ID \
  --table=TABLE_ID \
  --definition-file=DEFINITION_FILE_PATH

Replace the following:

• AUTHORIZED_VIEW_ID: a permanent identifier for the authorized view that is not already in use for the table
• INSTANCE_ID: the permanent identifier for the instance that contains the table
• TABLE_ID: the permanent identifier of that table you are creating an authorized view of
• DEFINITION_FILE_PATH: the path to a valid JSON formatted representation of an authorized view. For examples of correctly formatted definition files, see Definition file examples.

You can also run the command without supplying the definition file. In this case, the gcloud CLI opens an editor and prompts you for values.

To confirm that the authorized view has been created, get a list of authorized views for the table.

Java

try {
  CreateAuthorizedViewRequest request =
      CreateAuthorizedViewRequest.of(tableId, authorizedViewId)
          .setAuthorizedViewType(
              SubsetView.create()
                  .addRowPrefix("")
                  .setFamilySubsets(
                      COLUMN_FAMILY,
                      FamilySubsets.create().addQualifierPrefix(COLUMN_QUALIFIER_NAME)));
  AuthorizedView authorizedView = adminClient.createAuthorizedView(request);
  System.out.printf("AuthorizedView: %s created successfully%n", authorizedView.getId());
} catch (NotFoundException e) {
  System.err.println(
      "Failed to create an authorized view from a non-existent table: " + e.getMessage());
}

Console

1. Open the list of Bigtable instances in the Google Cloud console.

   Open the instance list

2. Click the instance that contains the authorized view.

3. In the navigation pane, click Bigtable Studio.

4. In the explorer, expand the table and Authorized views.

5. Next to the authorized view that you want to modify, click the more_vert action menu, and then click Open.

6. Modify or add clauses to build a query that returns only data that you want the authorized view users to have access to.

   • Acceptable clauses for an authorized view are row key prefix and columns (column qualifiers).
   • To specify a column qualifier prefix, add an asterisk after the prefix. For example, to include all columns that start with "data", enter data* in the Columns field after the column family name.
   • The Limit clause is ignored when the authorized view is saved.
   • For more information on using the query builder, see Build queries in the console.

7. Click Run.

8. After you've verified that the results pane shows data that should be included in the authorized view, click Save as view.

9. In the dialog, enter the ID of the authorized view that you modified.

   The dialog displays a message warning you that you are overwriting the existing authorized view.

10. Optional: To save without granting access, click Save.

11. Optional: To save the authorized view and then configure access for it, click Save & grant access. For more information about access control, see Bigtable access control with IAM.

    1. Add at least one principal and select the role to which that principal or group of principals should be assigned.
    2. Optional: To grant access for additional roles, click Add another role and then enter the principal and role for each additional role.
    3. Click Save.

gcloud

Modify an authorized view using the bigtable authorized-views update command. For more information, see the reference documentation at gcloud bigtable authorized-views update.

gcloud bigtable authorized-views update AUTHORIZED_VIEW_ID \
  --instance=INSTANCE_ID \
  --table=TABLE_ID \
  --definition-file=DEFINITION_FILE_PATH

Replace the following:

• AUTHORIZED_VIEW_ID: the permanent identifier for the authorized view
• INSTANCE_ID: the permanent identifier for the instance
• TABLE_ID: the permanent identifier of the source table
• DEFINITION_FILE_PATH: the path to a valid JSON formatted representation of an authorized view. For examples of correctly formatted definition files, see Definition file examples.

You can also run the command without supplying the definition file. In this case, the gcloud CLI opens an editor and prompts you for values.

Optional: To prevent the gcloud CLI from displaying a confirmation prompt showing the difference between the current authorized view structure and after the update is committed, append the --no-interactive flag to the command.

Java

try {
  // Update to an authorized view permitting everything.
  UpdateAuthorizedViewRequest request =
      UpdateAuthorizedViewRequest.of(tableId, authorizedViewId)
          .setAuthorizedViewType(
              SubsetView.create()
                  .addRowPrefix("")
                  .setFamilySubsets(
                      COLUMN_FAMILY, FamilySubsets.create().addQualifierPrefix("")));
  AuthorizedView authorizedView = adminClient.updateAuthorizedView(request);
  System.out.printf("AuthorizedView: %s updated successfully%n", authorizedView.getId());
} catch (NotFoundException e) {
  System.err.println("Failed to modify a non-existent authorized view: " + e.getMessage());
}

Console

1. Open the list of Bigtable instances in the Google Cloud console.

   Open the instance list

2. Click the instance that contains the authorized view.

3. In the navigation pane, click Bigtable Studio.

4. In the explorer, expand the table and Authorized views.

5. Next to the authorized view that you want to delete, click the more_vert action menu, and then click Delete.

gcloud

Delete an authorized view using the bigtable instances tables authorized-views delete command. For more information, see the reference documentation at gcloud bigtable authorized-views delete.

gcloud bigtable authorized-views delete AUTHORIZED_VIEW_ID \
  --instance=INSTANCE_ID \
  --table=TABLE_ID

Replace the following:

• AUTHORIZED_VIEW_ID: the permanent identifier for the authorized view
• INSTANCE_ID: the permanent identifier for the instance
• TABLE_ID: the permanent identifier of the source table

Optional: To prevent the gcloud CLI from displaying a confirmation prompt requiring you to confirm or cancel the deletion, append the --nointeractive flag to the command.

Java

try {
  adminClient.deleteAuthorizedView(tableId, authorizedViewId);
  System.out.printf("AuthorizedView: %s deleted successfully%n", authorizedViewId);
} catch (NotFoundException e) {
  System.err.println("Failed to delete a non-existent authorized view: " + e.getMessage());
}

Console

1. Open the list of Bigtable instances in the Google Cloud console.

   Open the instance list

2. Click the instance that contains the authorized view.

3. In the navigation pane, click Bigtable Studio.

4. In the explorer, expand the table and Authorized views.

gcloud

Run the bigtable authorized-views list command. For more information, see the reference documentation at gcloud bigtable authorized-views list.

gcloud bigtable authorized-views list \
  --instance=INSTANCE_ID \
  --table=TABLE_ID

Replace the following:

• INSTANCE_ID: the permanent identifier for the instance
• TABLE_ID: the permanent identifier for the table

Java

List<String> authorizedViewIds = new ArrayList<>();
try {
  authorizedViewIds = adminClient.listAuthorizedViews(tableId);
  for (String authorizedViewId : authorizedViewIds) {
    System.out.println(authorizedViewId);
  }
} catch (NotFoundException e) {
  System.err.println(
      "Failed to list authorized views from a non-existent table: " + e.getMessage());
}

Console

1. Open the list of Bigtable instances in the Google Cloud console.

   Open the instance list

2. Click the instance that contains the authorized view.

3. In the navigation pane, click Bigtable Studio.

4. In the explorer, expand the table and Authorized views.

5. Next to the authorized view that you want to view, click the more_vert action menu, and then click Open.

gcloud

To get details about an authorized view, run the bigtable instances tables authorized-views describe command. For more information, see the reference documentation at gcloud bigtable authorized-views describe.

gcloud bigtable authorized-views describe \
–-instance=INSTANCE_ID \
–-table=TABLE_ID \
AUTHORIZED_VIEW_ID

Replace the following:

• INSTANCE_ID: the permanent identifier for the instance
• TABLE_ID: the permanent identifier for the table
• AUTHORIZED_VIEW_ID: the permanent identifier for the authorized view

Java

AuthorizedView authorizedView = null;
try {
  authorizedView = adminClient.getAuthorizedView(tableId, authorizedViewId);
  SubsetView subsetView = (SubsetView) authorizedView.getAuthorizedViewType();

  for (ByteString rowPrefix : subsetView.getRowPrefixes()) {
    System.out.printf("Row Prefix: %s%n", rowPrefix.toStringUtf8());
  }
  for (Map.Entry<String, FamilySubsets> entry : subsetView.getFamilySubsets().entrySet()) {
    for (ByteString qualifierPrefix : entry.getValue().getQualifierPrefixes()) {
      System.out.printf(
          "Column Family: %s, Qualifier Prefix: %s%n",
          entry.getKey(), qualifierPrefix.toStringUtf8());
    }
    for (ByteString qualifier : entry.getValue().getQualifiers()) {
      System.out.printf(
          "Column Family: %s, Qualifier: %s%n", entry.getKey(), qualifier.toStringUtf8());
    }
  }
} catch (NotFoundException e) {
  System.err.println(
      "Failed to retrieve metadata from a non-existent authorized view: " + e.getMessage());
}

Console

1. Open the list of Bigtable instances in the Google Cloud console.

   Open the instance list

2. Click the instance that contains the authorized view.

3. In the navigation pane, click Bigtable Studio.

4. In the explorer pane, expand the table and Authorized views.

5. Next to the authorized view name, click the more_vert action menu, and then click Grant access.

6. Add at least one principal and select the role to which that principal or group of principals should be assigned.

7. Optional: To grant access for additional roles, click Add another role and then enter the principal and role for each additional role.

8. Click Save.

gcloud

To grant access to an authorized view, use the bigtable authorized-views add-iam-policy-binding command. For more information, see the reference documentation at gcloud bigtable authorized-views add-iam-policy-binding.

gcloud bigtable authorized-views add-iam-policy-binding AUTH_VIEW_ID \
--instance=INSTANCE_ID --table=TABLE_ID \
--member=PRINCIPAL --role=ROLE

Replace the following:

• AUTH_VIEW_ID: the ID for the authorized view
• TABLE_ID: the ID for the table that the authorized view is of
• INSTANCE_ID: the instance that contains the table
• PRINCIPAL: the principal (user) to whom you want to grant access, such as user:222larabrown@gmail.com
• ROLE: the role that you are granting, such as roles/bigtable.viewer.