Connect BigQuery
Overview of the BigQuery connection: service account, APIs, IAM, and the first scan.
A BigQuery connection is one service account JSON key stored for your SlashPeak account. That key is used to scan every GCP project you include after the IAM test.
Path
Enable the two required APIs on the project that will own the service account. See APIs.
Create the service account and custom roles. See Setup.
Grant the necessary role on every project you want in the product, or grant one org role on the organization. See IAM.
Paste the JSON key and test. See Connect in SlashPeak.
Let the scan finish. See Scans.
One key, many projects
The key lives in one GCP project (the “home” project). With Project level access, you grant the custom role on each project that should appear in SlashPeak. With Organization level access, you grant the scanner role on the home project and one org role on the organization, which covers every project, including new ones. After Test connection, the UI shows every project the key can resolve. Only projects with all necessary permissions can be selected.
With project-level access, repeat the grant step for new projects later, then test again.
An account has one active BigQuery connection.
What we never ask for
roles/bigquery.dataViewerbigquery.tables.getData- Permission to change datasets, jobs, or IAM in your org
These apply to the scanner key. The optional billing export asks for BigQuery Data Viewer on the one export dataset only. The Cognis AI DBA uses a separate key that you grant yourself.
Storage Read (bigquery.readsessions.create and bigquery.readsessions.getData) is used to stream INFORMATION_SCHEMA job, timeline, and storage results. It does not grant table contents.