Setting the rules under which data gets shared with others

Sharing data securely in BigQuery relies on IAM roles, authorized views/routines/datasets, and Analytics Hub rather than copying data across projects. These mechanisms let you control who can query, view, or subscribe to data while keeping a single source of truth and minimizing duplication and cost.

1 · Learn the must-know

• 1Authorized views let you grant users access to query results of a view without granting them access to the underlying source tables/datasets, enabling row- and column-level abstraction of sensitive data.
• 2Authorized datasets and authorized routines extend the same principle so an entire dataset or a specific stored procedure/UDF can be shared without exposing the base tables.
• 3IAM roles (e.g., BigQuery Data Viewer, Data Editor, Job User) should be granted at the dataset or table level following least privilege, rather than at the project level, to control read/write/run access.
• 4Analytics Hub lets data publishers create listings (exchanges) so subscribers can access shared, read-only, live BigQuery datasets across organizations without copying data, and it supports usage tracking and commercial data sharing.
• 5Row-level security and column-level security policies (via policy tags in Data Catalog/Dataplex) can be layered on top of IAM to restrict specific rows or sensitive columns for different user groups.
• 6VPC Service Controls and domain-restricted sharing can be combined with IAM to prevent data exfiltration when sharing data outside a trusted perimeter.

2 · Check your understanding