You are running a data warehouse on BigQuery. A partner company is offering a recommendation engine based on the data in your data warehouse. The partner company is also running their applica-tion…

Question

Options

• AAsk the partner to create a Service Account in their project, and have them give the Service
• BCreate a Service Account in your own project, and grant this Service Account ac-cess to
• CCreate a Service Account in your own project, and ask the partner to grant this Service Account
• DAsk the partner to create a Service Account in their project, and grant their Service Account

• A
  6% (3)
• B
  4% (2)
• C
  11% (5)
• D
  79% (37)

Explanation

The correct approach follows GCP IAM best practices: the partner creates a Service Account within their own project (giving them ownership and control of the identity), and you then grant that Service Account the necessary BigQuery permissions (e.g., roles/bigquery.dataViewer) on your dataset. This is preferable to creating a Service Account in your own project and sharing credentials (B, C), because the partner controls their own Service Account's lifecycle and key management. Option A is incorrect because it reverses the permission grant - the partner cannot grant your Service Account access to your own dataset. Option D correctly places the Service Account in the partner's project with you granting access to your resource.

No community discussion yet for this question.