# Google BigQuery connection #

To access your data in Google BigQuery, you must create a connection asset for it\.

Google BigQuery is a fully managed, serverless data warehouse that enables scalable analysis over petabytes of data\.

## Create a connection to Google BigQuery ##

To create the connection asset, choose an authentication method\. Choices include authentication with or without workload identity federation\.

**Without workload identity federation**

<!-- <ul> -->

 *  Credentials: The contents of the Google service account key JSON file
 *  Client ID, Client secret, Access token, and Refresh token

<!-- </ul> -->

**With workload identity federation**  
You use an external identity provider (IdP) for authentication\. An external identity provider uses Identity and Access Management (IAM) instead of service account keys\. IAM provides increased security and centralized management\. You can use workload identity federation authentication with an access token or with a token URL\.

You can configure a Google BigQuery connection for workload identity federation with any identity provider that complies with the OpenID Connect (OIDC) specification and that satisfies the Google Cloud requirements that are described in [Prepare your external IdP](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#oidc)\. The requirements include:

<!-- <ul> -->

 *  The identity provider must support OpenID Connect 1\.0\.
 *  The identity provider's OIDC metadata and JWKS endpoints must be publicly accessible over the internet\. Google Cloud uses these endpoints to download your identity provider's key set and uses that key set to validate tokens\.
 *  The identity provider is configured so that your workload can obtain ID tokens that meet these criteria:
    
    <!-- <ul> -->
    
     *  Tokens are signed with the RS256 or ES256 algorithm.
     *  Tokens contain an aud claim.
    
    <!-- </ul> -->
    
<!-- </ul> -->

For examples of the workload identity federation configuration steps and the Google BigQuery connection details for Amazon Web Services (AWS) and Microsoft Azure, see [Workload identity federation examples](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/wif-examples.html)\.

#### Workload Identity Federation with access token connection details ####

<!-- <ul> -->

 *  **Access token**: An access token from the identity provider to connect to BigQuery\.
 *  **Security Token Service audience**: The security token service audience that contains the project ID, pool ID, and provider ID\. Use this format:
    
        //iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID
    
    For more information, see [Authenticate a workload using the REST API](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds#rest).
 *  **Service account email**: The email address of the Google service account to be impersonated\. For more information, see [Create a service account for the external workload](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds#create_a_service_account_for_the_external_workload)\.
 *  **Service account token lifetime** (optional): The lifetime in seconds of the service account access token\. The default lifetime of a service account access token is one hour\. For more information, see [URL\-sourced credentials](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#url-sourced-credentials)\.
 *  **Token format**: Text or JSON with the Token field name for the name of the field in the JSON response that contains the token\.
 *  **Token field name**: The name of the field in the JSON response that contains the token\. This field appears only when the **Token format** is JSON\.
 *  **Token type**: AWS Signature Version 4 request, Google OAuth 2\.0 access token, ID token, JSON Web Token (JWT), or SAML 2\.0\.

<!-- </ul> -->

#### Workload Identity Federation with token URL connection details ####

<!-- <ul> -->

 *  **Security Token Service audience**: The security token service audience that contains the project ID, pool ID, and provider ID\. Use this format:
    
        //iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID
    
    For more information, see [Authenticate a workload using the REST API](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds#rest).
 *  **Service account email**: The email address of the Google service account to be impersonated\. For more information, see [Create a service account for the external workload](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds#create_a_service_account_for_the_external_workload)\.
 *  **Service account token lifetime** (optional): The lifetime in seconds of the service account access token\. The default lifetime of a service account access token is one hour\. For more information, see [URL\-sourced credentials](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#url-sourced-credentials)\.
 *  **Token URL**: The URL to retrieve a token\.
 *  **HTTP method**: HTTP method to use for the token URL request: GET, POST, or PUT\.
 *  **Request body** (for POST or PUT methods): The body of the HTTP request to retrieve a token\.
 *  **HTTP headers**: HTTP headers for the token URL request in JSON or as a JSON body\. Use format: `"Key1"="Value1","Key2"="Value2"`\.
 *  **Token format**: Text or JSON with the Token field name for the name of the field in the JSON response that contains the token\.
 *  **Token field name**: The name of the field in the JSON response that contains the token\. This field appears only when the **Token format** is JSON\.
 *  **Token type**: AWS Signature Version 4 request, Google OAuth 2\.0 access token, ID token, JSON Web Token (JWT), or SAML 2\.0\.

<!-- </ul> -->

### Other properties ###

**Project ID** (optional)

**Output JSON string format**: JSON string format for output values that are complex data types (for example, nested or repeated)\.

<!-- <ul> -->

 *  **Pretty**: Values are formatted before sending them to output\. Use this option to visually read a few rows\.
 *  **Raw**: (Default) No formatting\. Use this option for the best performance\.

<!-- </ul> -->

### Permissions ###

The connection to Google BigQuery requires the following BigQuery permissions:

<!-- <ul> -->

 *  `bigquery.job.create`
 *  `bigquery.tables.get`
 *  `bigquery.tables.getData`

<!-- </ul> -->

Use one of three ways to gain these permissions:

<!-- <ul> -->

 *  Use the predefined BigQuery Cloud IAM role `bigquery.admin`, which includes these permissions;
 *  Use a combination of two roles, one from each column in the following table; or
 *  Create a custom role\. See [Create and manage custom roles](https://cloud.google.com/iam/docs/creating-custom-roles)\.

<!-- </ul> -->

<!-- <table> -->

| First role            | Second role        |
| --------------------- | ------------------ |
| `bigquery.dataEditor` | `bigquery.jobUser` |
| `bigquery.dataOwner`  | `bigquery.user`    |
| `bigquery.dataViewer` |                    |

<!-- </table ""> -->

For more information about permissions and roles in Google BigQuery, see [Predefined roles and permissions](https://cloud.google.com/bigquery/docs/access-control)\.

### Choose the method for creating a connection based on where you are in the platform ###

**In a project** : Click **Assets > New asset > Connect to a data source**\. See [Adding a connection to a project](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/create-conn.html)\.

**In a deployment space** : Click **Add to space > Connection**\. See [Adding connections to a deployment space](https://dataplatform.cloud.ibm.com/docs/content/wsj/analyze-data/ml-space-add-assets.html)\.

**In the Platform assets catalog** : Click **New connection**\. See [Adding platform connections](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/platform-conn.html)\.

### Next step: Add data assets from the connection ###

<!-- <ul> -->

 *  See [Add data from a connection in a project](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/connected-data.html)\.

<!-- </ul> -->

## Where you can use this connection ##

You can use Google BigQuery connections in the following workspaces and tools:

**Projects**

<!-- <ul> -->

 *  Data Refinery
 *  SPSS Modeler
 *  Synthetic Data Generator

<!-- </ul> -->

**Catalogs**

<!-- <ul> -->

 *  Platform assets catalog

<!-- </ul> -->

## Google BigQuery setup ##

[Quickstart by using the Cloud Console](https://cloud.google.com/bigquery/docs/quickstarts/quickstart-web-ui)

## Learn more ##

<!-- <ul> -->

 *  [Google BigQuery documentation](https://cloud.google.com/bigquery/docs)
 *  [Google BigQuery workload identity federation examples](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/wif-examples.html)

<!-- </ul> -->

**Parent topic:**[Supported connections](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/conn_types.html)

<!-- </article "role="article" "> -->