Hey guys! I have a question about the integration with BigQuery. I have a Service Account from a different project where the data is located and :
• Service Account project: "...infrastructure"
• Data project: "...consumption"
And when I try to add the SA, I receive an error from GrowthBook: "Access Denied: Project ...infrastructure: User does not have bigquery.jobs.create permission in ...infrastructure.
The Service Account has the bigquery.jobUser role to create BQ jobs and the bigquery.dataViewer role to query the data. Using Python, our Data Engineer was able to authenticate and run queries without any issues. This leads us to think that GrowthBook doesn't allow the Service Account project to be different from the project where the data resides. I need to confirm if this is true or how to resolve it.
Thanks!
b
bumpy-queen-20789
09/11/2024, 6:09 AM
I have the same problem
👀 1
l
lemon-flower-28118
09/12/2024, 7:01 PM
Hi everyone! Do you have any workarounds for this problem, or is it mandatory to have the Service Account and Data in the same GCP project?
f
fresh-football-47124
09/12/2024, 8:01 PM
I'm not sure I understand enough about how GCP works - you want to use a service account that doesn't have access to the data?
l
lemon-flower-28118
09/13/2024, 12:19 PM
Hi @fresh-football-47124! I'm trying to use a Service Account from a different GCP project where the data is located, in accordance with our infrastructure guidelines:
• Service Account --> "infrastructure" GCP project
• Dataset --> "consumption" GCP project
The Service Account has the
bigquery.jobUser
and
bigquery.dataViewer
roles, and it can access the data using Python.
f
fresh-football-47124
09/13/2024, 3:40 PM
We try to run a query, and if we get any errors, we pipe that to the page you see.