[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-17 (世界標準時間)。"],[],[],null,["# Introduction to security and access controls in BigQuery\n========================================================\n\nThis document provides an overview of access controls in BigQuery\nusing Identity and Access Management (IAM). IAM lets you grant granular\naccess to specific BigQuery resources and helps prevent access to other\nresources. IAM helps you apply the security principle of least\nprivilege, which states that no [IAM principal](/iam/docs/principals-overview)\nshould have more permissions than they actually need.\n\nWhen an IAM principal such as a\nuser, group, or service account calls a Google Cloud API, that principal must\nhave the minimum IAM permissions necessary to use the resource.\nTo give a principal the required permissions, you grant an IAM\nrole to the principal.\n\nThis document describes how predefined and custom IAM roles can\nbe used to allow principals to access BigQuery resources.\n\nTo familiarize yourself with how access is managed in Google Cloud, see\n[IAM overview](/iam/docs/overview).\n\nIAM role types\n--------------\n\nA role is a collection of permissions that can be granted to an IAM\nprincipal. You can use the following types of roles\nin IAM to grant access to BigQuery resources:\n\n- [**Predefined roles**](/iam/docs/understanding-roles#predefined_roles) are managed by Google Cloud and support common use cases and access control patterns.\n- [**Custom roles**](/iam/docs/understanding-custom-roles) provide access according to a user-specified list of permissions. For information on creating custom roles, see [Create and manage custom roles](/iam/docs/creating-custom-roles) in the IAM documentation.\n\n| **Note:** When new capabilities are added to BigQuery, new permissions might be added to predefined IAM roles. Also, new predefined IAM roles can be added to BigQuery at any time. If your organization requires role definitions to remain unchanged, you should create [custom IAM roles](/iam/docs/creating-custom-roles).\n\nTo determine if one or more permissions are included in a predefined\nIAM role, you can use one of the following methods:\n\n- The [BigQuery IAM roles and permissions](/bigquery/docs/access-control) reference\n- The [IAM roles and permissions index](/iam/docs/roles-permissions)\n- The [`gcloud iam roles describe`](/sdk/gcloud/reference/iam/roles/describe) command\n- The [`roles.get()`](/iam/reference/rest/v1/roles/get) method in the IAM API\n\nIAM roles in BigQuery\n---------------------\n\nPermissions are not assigned directly to users, groups, or service accounts.\nInstead, users, groups, or service accounts are granted one or more predefined\nor custom roles that grant them permissions to perform actions on resources. You\ngrant these roles on a particular resource, but they also apply to all of that\nresource's descendants in the [resource hierarchy](/resource-manager/docs/cloud-platform-resource-hierarchy).\n\nWhen you assign multiple role types to a user, the permissions granted are a\nunion of each role's permissions.\n\nYou can grant access to the following BigQuery resources:\n\n- Datasets and these resources within datasets:\n - Tables and views\n - Routines\n- Connections\n- Saved queries\n- Data canvases\n- Data preparations\n- Pipelines\n- Repositories\n\n### Grant access to Resource Manager resources\n\nYou can configure access to BigQuery resources through\nResource Manager by granting a BigQuery role to a principal and\nthen by granting that role on an organization, a folder, or a project.\n\nWhen you grant roles to Resource Manager resources such as organizations and\nprojects, you're granting permissions on **all** of the BigQuery\nresources in the organization or project.\n\nFor additional information on using IAM to manage access to\nResource Manager resources, see\n[Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access)\nin the IAM documentation.\n\n### Grant access to datasets\n\nYou can assign roles at the dataset level to provide access to a specific\ndataset, without providing complete access to the project's other resources. In\nthe [IAM resource hierarchy](/iam/docs/overview#policy_hierarchy),\nBigQuery datasets are child resources of projects. For more information\non assigning roles at the dataset level, see\n[Control access to resources with IAM](/bigquery/docs/control-access-to-resources-iam).\n| **Caution:** Don't grant BigQuery basic roles to datasets. BigQuery's dataset-level basic roles existed prior to the introduction of IAM. BigQuery basic roles provide excessive and uneven access, and you are discouraged from using them. For example, the `Owner` basic role does *not* provide table access permissions. For more information, see [Basic roles \\& permissions](/bigquery/docs/access-control-basic-roles).\n\n### Grant access to individual resources within datasets\n\nYou can grant roles access to certain types of resources within datasets,\nwithout providing complete access to the dataset's resources.\n\nRoles can be applied to the following resources within datasets:\n\n- Tables and views\n- Routines\n\n| **Note:** Roles cannot be applied to models.\n\nFor more information on assigning roles at the table, view, or routine level,\nsee [Control access to resources with IAM](/bigquery/docs/control-access-to-resources-iam).\n\nWhat's next\n-----------\n\n- For more information about assigning roles to BigQuery resources, see [Control access to resources with\n IAM](/bigquery/docs/control-access-to-resources-iam).\n- For a list of BigQuery predefined IAM roles and permissions, see [BigQuery IAM roles and\n permissions](/bigquery/docs/access-control)."]]
