Connect BigQuery

​

Before you start

• Permission in the Google Cloud project to enable APIs, create service accounts and grant IAM roles (for example Owner, or Service Account Admin plus Project IAM Admin)
• The ID and location of the dataset Kubit should query

​

Steps

1

Enable the BigQuery API

If the BigQuery API is already on for the project, skip this step.In the Google Cloud console, open APIs & Services and click Enable APIs and Services. Search for BigQuery API, select it and click Enable.

2

Create a service account

Open APIs & Services > Credentials and select your project if asked. Click Create Credentials > Service account.Name the account Kubit and click Create. The Service account email shown is the Kubit service account email.

3

Grant BigQuery roles

Give the Kubit service account these three roles on the project:

Role	Why
BigQuery User	Lists datasets and runs queries in the project
BigQuery Job User	Runs query jobs
BigQuery Data Viewer	Reads table and view data

The same grants from the command line, with <project-id> and the service account email replaced:

for role in roles/bigquery.user roles/bigquery.jobUser roles/bigquery.dataViewer; do
  gcloud projects add-iam-policy-binding <project-id> \
    --member="serviceAccount:<kubit-service-account-email>" \
    --role="$role"
done

4

Create a JSON key

Select the Kubit service account, open Keys and click Add Key > Create new key. Choose JSON and click Create. A JSON private key downloads to your computer.

The JSON key gives read access to your BigQuery data. Store it in a password manager or secret store, never in a repo or chat message.

5

Add the connection in Kubit

Kubit needs three values: the JSON private key, the dataset ID and the dataset’s region and zone.

For help with the setup, share the same three values with the Kubit team through a secure channel such as a password manager.

​

Verify

gcloud projects get-iam-policy <project-id> \
  --flatten="bindings[].members" \
  --filter="bindings.members:serviceAccount:<kubit-service-account-email>" \
  --format="value(bindings.role)"

​

Next steps

• Bring your own warehouse: how Kubit queries your warehouse in place.
• Allow Kubit’s IP ranges: let Kubit through VPC Service Controls or a firewall.