Credentials
Atoti DirectQuery delegates the credentials handling to a Google BigQuery Java client.Service account key file
A classic way to authenticate is to use a Service Account key file. This requires creating a Google Cloud service account with the correct permissions. The secret key is then saved locally and used. There are two common ways to pass this service account key file to the BigQuery Java client:- Put the path to the key file in the
GOOGLE_APPLICATION_CREDENTIALSenvironment variable. See Application Default Credentials. - Read the content of the key file and pass it to the client builder. See Loading credentials from a file.
How to authenticate as a user
Instead of a service account, it is also possible to use the credentials of a specific user using OAuth2 flow. This setup involves more steps and is described in the Google guide for authenticating as an end user.Permissions
The service account or user used by DirectQuery must have the permissions to access the datasets and run jobs in BigQuery. A simple way to achieve this is to give the BigQuery User and BigQuery Data Viewer roles to the user. If those roles grant too many permissions, a role with this minimal set of permissions can be created instead:bigquery.datasets.getbigquery.jobs.createbigquery.readsessions.createbigquery.readsessions.getDatabigquery.readsessions.updatebigquery.routines.getbigquery.tables.getbigquery.tables.getDatabigquery.tables.list