Dedicated SA
Never personal user keys.
Learn · Security
Read-only BigQuery service account
Least privilege for monitoring tools.
The problem
Over-scoped service accounts are how “monitoring” becomes a data exfil risk story.
The outcome
Grant the narrowest roles that read metadata and job stats; document and revoke anytime.
Principle
Least privilege
Data
No row reads
Ops
Revocable
What you get
Document roles
Security reviewers will ask.
Separate projects carefully
Know what the SA can see.
Test in demo first
Reduce pressure during review.
- ✓Security: /security
- ✓Start: /start
- ✓Docs: /docs
- ✓Privacy: /privacy
Try VectorData, then decide
Open workspace, or book a Data Stack Health Audit credited toward Managed.