This tool provides easier permission management for BigQuery.

Currently supports;

• list the user's permissions for each BigQuery Datasets
• permit users to each BigQuery Datasets access role (READER/WRITER/OWNER) and roles/bigquery.jobUser (to run query)
• permit users to Project-wide access role (roles/viewer or rolse/editor)
• revoke users' datasets and/or project-wide permissions

You must have a roles/owner on your GCP project.

$ go get -u github.com/hirosassa/bqiam

Prepare configuration file as following format (currently support only the file name is .bqiam.toml on your $HOME):

// .bqiam.toml
BigqueryProjects = ["project-id-A", "project-id-B", ...]
CacheFile = "path/to/cache-file.toml"

Next, fetch bigquery dataset metadata and store it to cache file (take about 30-60 sec.).

$ bqiam cache
dataset meta data are cached to path/to/cache-file.toml

List datasets the user is able to access.

$ bqiam dataset [email protected]
sample-prj sample-ds1 OWNER
sample-prj sample-ds2 READER
...

Grant the user(s) a role to access the dataset(s). This command also adds roles/bigquery.jobUser automatically.

$ bqiam permit dataset READER -p bq-project-id -u [email protected] -u [email protected] -d dataset1 -d dataset2
Permit [email protected] to dataset1 access as READER
Permit [email protected] to dataset1 access as READER
...

Grant the user(s) a project-wide role.

$ bqiam permit project READER -p bq-project-id -u [email protected] -u [email protected]
Permit [email protected] to bq-project-id access as READER
Permit [email protected] to bq-project-id access as READER
...

Revoke the user(s)' access permissions.

$ bqiam revoke dataset READER -p bq-project-id -u [email protected] -d dataset1
Revoked [email protected]'s permission of dataset1 access as READER

$ bqiam project READER -p bq-project-id -u [email protected] -u [email protected]
Revoked [email protected]'s permission of bq-project-id access as READER
Revoked [email protected]'s permission of bq-project-id access as READER

Completion is available for bash or zsh. Download projects, datasets, users list data via GCP API.

bqiam completion bash > /path/to/bash-completion/completions/bqiam

bqiam completion zsh > /path/to/zsh-completions/_bqiam

Completion candidate data is downloaded to ~/.bqiam-completion-file.toml by following command.

bqiam completion