Provisions a GCP app with access to BigQuery.
This capability grants the app's service account BigQuery roles and injects the connection
details it needs to address a dataset. Connect it to a gcp-bigquery-dataset block (or
gcp-existing-bigquery-dataset) to scope the grants and populate the environment variables.
access is a list of BigQuery role suffixes, each granted as roles/bigquery.<item> — for
example dataViewer or jobUser. See the variable description for the full list of valid
values.
Where a role is granted depends on whether a dataset connection is present.
When a dataset is connected, the data-access roles are scoped to that dataset only:
| Role | Scope with a dataset connected |
|---|---|
dataOwner, dataEditor, dataViewer, metadataViewer, filteredDataViewer |
the connected dataset |
everything else (jobUser, user, admin, …) |
the project |
The second row is not an oversight. BigQuery does not support those roles on a dataset
resource — running a query requires jobUser at the project level regardless of which dataset
the query touches — so they stay project-scoped and connecting a dataset never breaks them.
With no dataset connected, every role is granted at the project level, which means
dataEditor becomes dataEditor on every dataset in the project. Connect the dataset you
actually use.
Grants use google_bigquery_dataset_iam_member and google_project_iam_member, never
_iam_binding. A binding is authoritative for the role and would silently strip every other
member on the next apply.
| Variable | Description |
|---|---|
BIGQUERY_DATASET |
The connected dataset id. Empty when no dataset is connected. |
BIGQUERY_PROJECT |
The project owning the dataset, falling back to the app's project. |
BIGQUERY_DATASET_LOCATION |
The dataset's location. Empty when no dataset is connected. |
BIGQUERY_PROJECT and BIGQUERY_DATASET_LOCATION exist because a client that must build a
fully qualified project.dataset.table, or run a job in the dataset's location, would
otherwise have to hardcode values Nullstone already knows.
Under a capability namespace of FOO, these arrive prefixed as FOO_BIGQUERY_DATASET and
so on, which is how an app maps them onto whatever names its own configuration expects.