Access gRPC endpoints for Dataproc Metastore

This page explains how to grant a Google Cloud user account or a service account access to a Dataproc Metastore service that uses the gRPC endpoint protocol.

About granting gRPC metadata roles

When granting an account access to your metadata, consider the following concepts:

• The level of access to provide. The level of access you grant controls how much metadata that an account can access. For example, you can choose to provide access to metadata stored in a specific database, a specific table, or you can provide access to your entire project.

• The principal that requires access. You use IAM principals (identities) to run your jobs. For example, you can run Dataproc cluster jobs with user accounts or service accounts (typically the Dataproc VM service account).

  For more information about the accounts you can use with Dataproc Metastore, see Dataproc service accounts.

Depending on the scope of control required, grant your principal one of the following predefined IAM roles:

• To grant full access to the metadata resources. Metadata Owner role (roles/metastore.metadataOwner)
• To grant read-write access to metadata: Metadata Editor role roles/metastore.metadataEditor)
• To grant read access to the metadata: Metadata Viewer role (roles/metastore.metadataViewer)

Before you begin

• Enable Dataproc Metastore in your project.
• Create a metastore service that uses the gRPC protocol.

• Understand networking requirements specific to your project.

  • gRPC and Virtual Private Cloud (VPC) requirements. If you're using gRPC, you don't have to configure a Shared VPC or set any extra network configurations. By default, gRPC endpoints can be reached from any VPC.

  However, there's one exception. If your project is using a VPC-SC service perimeter, then gRPC endpoints can only be reached from a VPC belonging to projects in the perimeter. For more information, see VPC Service Controls with Dataproc Metastore.

Required Roles

To get the permissions that you need to grant a principal access to Dataproc Metastore metadata, ask your administrator to grant you the following IAM roles on your project, while following the principle of least privilege:

• To grant full control of Dataproc Metastore resources (roles/metastore.editor)
• To grant full control of Dataproc Metastore resources, including updating IAM permissions (roles/metastore.admin)

For more information about granting roles, see Manage access to projects, folders, and organizations.

These predefined roles contain the permissions required to grant a principal access to Dataproc Metastore metadata. To see the exact permissions that are required, expand the Required permissions section:

You might also be able to get these permissions with custom roles or other predefined roles.

Grant a principal account access to metadata

You can grant a principal account access to metadata at the project level, service level, database level, or table level.

Grant access at the project level

To grant access to all Dataproc Metastore metadata at the project level, you must grant a metadata role to your principal account.

gcloud projects add-iam-policy-binding PROJECT_ID \
    --member=PRINCIPAL \
    --role=METASTORE_ROLE

Grant access at the service level

To grant access to all Dataproc Metastore metadata at the service level, you must grant a metadata role to your principal account.

gcloud metastore services add-iam-policy-binding SERVICE_ID \
  --location=LOCATION \
  --member=PRINCIPAL \
  --role=METASTORE_ROLE

Grant access at the database level

To grant access to all Dataproc Metastore metadata in a specific database, you must add a metadata role to your principal account.

gcloud metastore services databases add-iam-policy-binding DATABASE_ID \
  --project=PROJECT \
  --location=LOCATION \
  --service=SERVICE_ID \
  --member=PRINCIPAL \
  --role=METASTORE_ROLE

Grant access at the table level

To grant access to all Dataproc Metastore metadata in a specific table, you must grant a metadata role to your principal account.

gcloud metastore services databases tables add-iam-policy-binding TABLE_ID \
  --database=DATABASE_ID \
  --project=PROJECT \
  --location=LOCATION \
  --service=SERVICE_ID \
  --member=PRINCIPAL \
  --role=METASTORE_ROLE

After you grant access to your metadata

After you grant the required roles to your service accounts, you can connect your Dataproc Metastore to a Dataproc cluster. Your cluster then uses the Dataproc Metastore service as its Hive Metastore.

What's next

• Attach a Dataproc cluster
• Update and delete Dataproc Metastore
• Import metadata into Dataproc Metastore