Connect in SlashPeak
Paste the service account JSON, test IAM per project, choose which projects to scan, and save the connection.
Open Connect BigQuery after the service account and roles exist. Owners can save a connection. Viewers cannot.
The page has three sections: Access level (project or organization), Google Cloud setup (the commands and Console steps from BigQuery setup), and Service account key (this page).
Paste the JSON key
Paste the full key file. SlashPeak checks that it is JSON, type is service_account, and required fields are present (project_id, private_key, client_email, and the usual Google key fields).
Invalid JSON never leaves the browser check. A valid key is sent to Test connection, which talks to Google with that identity.
If you would rather not paste the whole file, switch to Enter fields and enter the project ID, client email and private key from the same JSON file.
Treat the file as a secret
Do not commit the JSON. Do not paste it into tickets. If it leaks, delete the key in GCP and create a new one, then replace it in SlashPeak.
Test connection
Test connection does three things:
- Authenticates as the service account.
- Resolves GCP projects the identity can see.
- Runs
testIamPermissionsfor necessary and optional permissions on each project.
Project colors
| Color | Meaning | Can scan? |
|---|---|---|
| Green | All necessary permissions granted, included | Yes |
| Grey | Granted, but you clicked to exclude | No, until you include it |
| Red | Missing at least one necessary permission | No |
Click a green card to exclude it. Click it again to include it. You must keep at least one green project selected to save.
Expand a card to see each permission: granted, not granted, could not check, or granted above the project (org-scoped).
Project search lists only the projects where the key has resourcemanager.projects.get, and shows up to 100. If the list shows only the key’s home project, grant that permission at folder or org, or bind the necessary role on each project. With Organization level access, projects other than the home project need only the org role to turn green.
Save
Save connection encrypts the key and stores it for scans. An account has one active BigQuery connection, so saving a new key deactivates the previous one. Historical scan rows remain; they are no longer the active source. Connections to other warehouses are not affected.
Saving does not start a scan by itself. In the setup wizard, the last step starts the first scan. Outside the wizard, the first scan starts at the next scheduler run (it checks about every 15 minutes), as long as your plan scans automatically. Watch progress on the Connections page.
Replace a key
On Connections, open the Settings tab and press Edit connection when you rotate keys. After a warning, it opens setup at the BigQuery step. Basics (timezone and data region) are locked there; change them in Settings. You can also switch between project and organization access and change the projects. Test again so IAM is confirmed on the new identity. Update role bindings if the new service account email is different.
Regions
Each scan starts by finding the BigQuery locations of the selected projects, so a region you start using later is picked up on the next scan. SlashPeak looks in two places:
- Dataset locations: always.
- Regions billed for BigQuery (billing export): when the billing export is set up.
To skip a region, add it under Excluded regions in the Settings tab on the Connections page. The next scan uses the change. At least one found region must stay in scans. A region is never removed when it goes quiet; exclude it if you do not want it scanned.
Delete all reports
On Connections, an owner can open the Settings tab, press Delete all reports, and type FLUSH ALL to confirm. SlashPeak deletes every scan, finding, cached table and chart for that connection. The connection and its key stay, so the next scan builds the reports again. This cannot be undone. If a scan is running, wait for it to finish, then try again.
Delete a connection
On Connections, an owner can open the Settings tab, press Delete connection, and type DELETE CONNECTION to confirm. SlashPeak deletes the service account key, the AI DBA operator key, the dbt Cloud token, and every scan, finding and cached table for that connection. It also deletes the BigQuery audit log entries that SlashPeak copied from your Cloud Logging. SlashPeak's own entries (for example, that a flush happened) stay in the audit log. Queued AI DBA actions are canceled. This cannot be undone. If a scan is running, wait for it to finish, then delete.
To also remove SlashPeak's access on the Google side, delete the service account key in Google Cloud.