Google BigQuery

Keel connects with a service-account key; every job carries maximumBytesBilled, and profiling dry-runs first.

Read-only role script

# Run in Cloud Shell as a project owner, then paste the key file into Keel.
gcloud iam service-accounts create keel-reader --project acme-analytics --display-name "Anchor Keel (read-only)"
# Read table data and metadata, and run query jobs (billed to this project) — nothing else.
gcloud projects add-iam-policy-binding acme-analytics \
  --member serviceAccount:keel-reader@acme-analytics.iam.gserviceaccount.com --role roles/bigquery.dataViewer
gcloud projects add-iam-policy-binding acme-analytics \
  --member serviceAccount:keel-reader@acme-analytics.iam.gserviceaccount.com --role roles/bigquery.jobUser
# Optional, for usage-based inference: query history (INFORMATION_SCHEMA.JOBS).
gcloud projects add-iam-policy-binding acme-analytics \
  --member serviceAccount:keel-reader@acme-analytics.iam.gserviceaccount.com --role roles/bigquery.resourceViewer
gcloud iam service-accounts keys create keel-reader.json --iam-account keel-reader@acme-analytics.iam.gserviceaccount.com

Before you run it:

• Run it in Cloud Shell as a project owner. Replace acme-analytics with your project.
• roles/bigquery.dataViewer can be granted on individual datasets instead of the project to narrow what Keel sees; roles/bigquery.jobUser stays on the project that pays for queries.
• roles/bigquery.resourceViewer is optional (query history in INFORMATION_SCHEMA.JOBS, for usage-based inference).

In Keel

Sources › Connect source › Google BigQuery: Project ID, service account, key JSON, optional location, maximum GB billed per query (default 10), API endpoint. Then Test: Keel checks the network, authentication, metadata access, least privilege and query-log access, and warns if the principal can write.

How this script is verified

Syntax-checked only. IAM cannot be tested against the BigQuery emulator, so the script is not run; every docs build lints it (only gcloud commands binding read-only BigQuery roles) and a unit test keeps it identical to the product's. See Connect sources.