IAM permissions

SlashPeak asks for atomic permissions on a custom role, not a named Google role like “BigQuery Job User”. That way setup copy and the Test connection screen name the exact strings your security team will see.

Necessary permissionsCopy Anchor Link

Without these, a project stays red and cannot be scanned.

Why Storage Read is listedCopy Anchor Link

bigquery.readsessions.create and bigquery.readsessions.getData open a Storage Read session against INFORMATION_SCHEMA results (jobs, jobs timeline, table storage). They do not grant SELECT on your datasets. SlashPeak never requests roles/bigquery.dataViewer or bigquery.tables.getData.

Why jobs.create is listedCopy Anchor Link

Scans run metadata queries (INFORMATION_SCHEMA.JOBS, tables, storage, reservations). Those queries are BigQuery jobs. The scanner identity must be allowed to create them. Bytes billed for those jobs are metadata-sized; still, you will see the scanner email in job history.

Why jobs.listAll is listedCopy Anchor Link

INFORMATION_SCHEMA.JOBS_BY_PROJECT and the jobs timeline return only your own jobs without it, so the jobs query fails. It shows who ran each query, when, the SQL text, bytes billed and slot time. It never shows query results.

Organization-level accessCopy Anchor Link

If you pick Organization level in Connect BigQuery, the project that owns the service account still gets the necessary role above, because scan queries run there. A second custom role, granted once on the organization, covers every other project. A project other than the home project counts as scannable when it inherits the first four permissions below:

• bigquery.jobs.listAll (read every user's job history)
• bigquery.datasets.get (list datasets and read their settings)
• bigquery.tables.get
• bigquery.tables.list
• resourcemanager.projects.get (used only by Test connection to find your projects)

Optional permissionsCopy Anchor Link

Grant these on a second custom role if you want tags, lineage, Knowledge Catalog, and audit logs.

What we never requestCopy Anchor Link

• roles/bigquery.dataViewer
• bigquery.tables.getData
• Write permissions (*.update, *.delete, *.setIamPolicy on your datasets)

Two opt-in features are outside the scanner role. The optional billing export needs BigQuery Data Viewer on that one export dataset, and nothing else. The Cognis AI DBA uses its own, separate key with only the write permissions for the fixes you turn on.

See the public Security page for the same list in marketing form.

Verify before you paste a keyCopy Anchor Link

1. Create the custom role.
2. Bind it on a test project.
3. In SlashPeak, paste the JSON and click Test connection.
4. Expand the project card. Necessary rows should show granted.
5. Fix red rows, test again, then save.