Google BigQuery

Google BigQuery connections allow SPACE to query BigQuery data directly and use it as a connected data source, including alongside IBM Planning Analytics in SPACE AI.

A BigQuery connection represents one Google Cloud project and BigQuery dataset.

Before you begin

Identify the Google Cloud project and BigQuery dataset that SPACE should access.

For standard read-only use, the Google identity used by SPACE should have:

• BigQuery Job User (roles/bigquery.jobUser) on the project where SPACE executes queries.
• BigQuery Data Viewer (roles/bigquery.dataViewer) on the dataset SPACE needs to read.

These permissions allow SPACE to execute BigQuery queries, discover dataset metadata, and read tables and views without granting broader write or administrative access.

If a view references data in another dataset, the Google identity also needs access to the underlying data unless Google BigQuery authorized views or authorized datasets are used.

Creating or editing a BigQuery connection

Choose New connection, or open an existing Google BigQuery connection.

Configure:

• Connection Type – Google BigQuery.
• Environment Type – descriptive label such as Production, UAT, QA, Development, or Sandbox.
• Name – friendly name shown throughout SPACE.
• Project ID – Google Cloud project that SPACE will use.
• Dataset – BigQuery dataset associated with the connection.

Then configure User credentials using Google OAuth or a Google service account.

User credentials

SPACE supports two authentication options for interactive use:

Authentication	Identity used to access BigQuery
Google OAuth (SSO)	Each SPACE user authenticates with their own Google account and uses their existing Google Cloud IAM permissions.
Google Service Account	All SPACE users with access to the connection use the same configured Google service account and its BigQuery permissions.

Google OAuth (SSO)

Use Google OAuth when individual users should access BigQuery with their own Google identity and existing Google Cloud permissions.

In Google Cloud:

1. Ensure the BigQuery API is enabled.
2. Configure the Google OAuth application as appropriate for your organization.
3. Create an OAuth client with application type Web application.
4. Copy the exact Authorized Redirect URI displayed by SPACE into the OAuth client's authorized redirect URIs.
5. Copy the resulting Client ID and Client Secret into the SPACE connection.

Each SPACE user who uses the connection must have the required BigQuery permissions, either directly or through Google groups.

The first time a user accesses the connection, SPACE starts the Google OAuth flow. The user signs in with Google and grants access. Future requests can reuse the stored OAuth authorization while Google Cloud IAM continues to control the data available to that user.

Google Service Account

Use Google Service Account when the connection should use one centrally managed Google identity for all authorized SPACE users.

In Google Cloud:

1. Create or select a dedicated service account.
2. Grant it BigQuery Job User on the required project.
3. Grant it BigQuery Data Viewer on the required dataset.
4. Create a JSON key for the service account.
5. Transfer the JSON securely to the SPACE administrator.

In SPACE, select Google Service Account and paste the complete JSON key into Service Account Credentials.

The JSON contains private-key material and should be treated as a sensitive credential.

No individual Google login is required when this authentication method is used. All SPACE users of the connection operate with the BigQuery permissions assigned to the service account.

Which user authentication should you use?

Use Google OAuth (SSO) when you want:

• each user to authenticate with their own Google account;
• existing Google Cloud IAM permissions to remain effective;
• different users to have different BigQuery access;
• per-user identity and auditability.

Use Google Service Account when you want:

• one centrally managed BigQuery identity;
• the same underlying BigQuery permissions for users of the SPACE connection;
• no individual Google login for each SPACE user.

For organizations that already manage BigQuery security at the individual-user or Google-group level, Google OAuth is generally the more natural model. A service account is simpler when one shared identity is appropriate.

Job credentials

Job authentication is configured separately from interactive user authentication.

For Google BigQuery, Job credentials support Google Service Account authentication only.

Paste the complete service-account JSON into Service Account Credentials. SPACE can then use that service account for supported non-interactive jobs that need access to the BigQuery connection.

The service account must have the required BigQuery permissions for the configured project and dataset.

Use Test connection to verify the configured credentials and access before relying on the connection in automated workflows.