Manage Data
What this domain tests
Manage data covers access control, governance, retention, encryption, auditability, and cost control across BigQuery and Cloud Storage. Questions test least privilege, dataset-level permissions, column and row security, lifecycle rules, and monitoring.
Core rules
- Grant least privilege with predefined roles: BigQuery Data Viewer, BigQuery Job User, BigQuery Data Editor, Storage Object Viewer. Primitive roles such as Owner and Editor are too broad.
- BigQuery access can be granted at dataset, table, or view level. An authorized view lets users query selected columns without access to the underlying table.
- Column-level access uses policy tags through Dataplex/Data Catalog; row-level access uses row access policies. Both are preferable to copying data into less secure tables.
- Encryption at rest is default with Google-managed keys. CMEK uses Cloud KMS keys and requires granting the BigQuery service account access to the key.
- Cloud Storage lifecycle rules transition or delete objects by age, storage class, or version. BigQuery supports table expiration and partition expiration; time travel keeps table data for seven days by default.
- Monitor cost with budgets and alerts, custom quotas, and INFORMATION_SCHEMA jobs views. Audit access with Cloud Audit Logs; BigQuery Data Access audit logs are not enabled by default and must be turned on.
Worked example
An analyst needs revenue by region but must not see customer email addresses. Reasoning: do not grant BigQuery Data Viewer on the base table. Create a view that selects region, revenue, and other non-PII columns, authorize the view on the dataset, and grant the analyst BigQuery Data Viewer on the view only. This enforces column exclusion without duplicating data. If row-level restrictions are also needed, add a row access policy. Grant BigQuery Job User at project level so the analyst can run queries, but keep table access limited. This follows least privilege and keeps the PII column protected.
Traps
- Granting roles/bigquery.dataViewer at project level for a single dataset.
- Forgetting to authorize a view, so it fails with access denied.
- Setting table expiration and accidentally deleting production data.
- Enabling CMEK without granting the service account key access.
- Assuming audit logs capture data reads by default.
- Using dataset copies as a security boundary instead of views and policies.