Connect to BigQuery using GCP Service Account

Q&A
, ,
1

Is there a way to connect to BigQuery using a GCP service account? The Amazon Quick Sight now Supports Connectivity to Google BigQuery is a nice feature but it uses the person login (OAuth). The API also takes access token / refresh token as the “password”. So if the refresh token expires or access is revoked because an employee leaves, the dataset for a shared dashboard would be invalid. For example, when building an embedding dashboard, the dataset/datasource should be a service account.

Am I missing something in my product understanding? Can I use a GCP service account to connect to BigQuery?

2

Hello Hong,

First of all Welcome to the Quick Suite Community.

Currently, QuickSight’s BigQuery integration primarily uses OAuth-based authentication (personal login), which creates the exact challenges you’ve identified for shared dashboards and embedding scenarios.

QuickSight currently supports BigQuery connections through:

  • OAuth authentication using personal Google account credentials

  • Required permissions at the Google Cloud level:

    • BigQuery Job User at the Project level

    • BigQuery Data Viewer at the Dataset or Table level

    • BigQuery Metadata Viewer at the Project level

The Service Account Challenge

You’re right that this approach may have limitations:

  1. Token expiration: Refresh tokens can expire, breaking dashboard access

  2. Employee turnover: When employees leave, their OAuth access is revoked, invalidating shared dashboards

If i am not mistaken , direct GCP service account authentication is not currently supported in QuickSight’s BigQuery connector. However, here are some potential approaches which i can think of :

1. Shared Service Account Approach

  • Create a dedicated Google account (not tied to an individual)

  • Use this account for QuickSight connections

  • Manage the account credentials centrally

  • Grant appropriate BigQuery permissions to this service account

2. Making multiple data set co-owner

  • Co-owner should be able to edit and maintain the dataset

The current OAuth limitation is a known constraint, and AWS may enhance this in future releases to support service account.

Hope this gives some insight.

Cheers,

Deep