Domain 4 of 5 · Chapter 3 of 3

Sharing Data

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Professional Data Engineer premium course — no separate purchase.

Included in this chapter:

  • Share derived results without granting source access
  • Publish across orgs with BigQuery sharing (Analytics Hub)
  • Clean rooms, travelling controls, and Looker Studio reports
  • Exam-pattern recognition

Choosing a BigQuery data-sharing mechanism

MechanismDirect IAM grantAuthorized view / dataset / routineBigQuery sharing (Analytics Hub)Data clean room
What the consumer getsRead on the actual tableQuery results of a SELECT onlyRead-only linked dataset (pointer)Restricted query access, no row visibility
Sees source rows/columnsYes, all of themOnly what the view exposesSubject to source RLS/CLSNo, rows never revealed
Crosses orgs / projectsWithin IAM reachSame-org sharingYes, publish-and-subscribeYes, between parties
Data copiedNoNoNo (linked dataset)No
Typical useTrusted analyst needs all dataHide sensitive columns/rows from a teamDistribute a dataset to partnersJoint analysis without exposing each other's data

Decision tree

Consumer needs a chart,not query access?YesLooker Studio reportshare view / schedule deliveryNoParties join withoutrevealing each other's rows?YesData clean roomanalysis rules + egressNoConsumer in anotherproject or organization?YesBigQuery sharinglisting to linked datasetNoMust hide some columnsor rows from them?YesAuthorized viewauthorized dataset for manyNoDirect IAM granttrusted, needs full tableAlways: source row-level and column-level security keep applying through every share
Cheat sheet

Cheat sheet

  • Use an authorized view to share results without source access
  • Group views into an authorized dataset instead of authorizing each one
  • Authorize a routine to share query logic, not table access
  • BigQuery sharing distributes a dataset via publish-and-subscribe
  • Subscribing yields a read-only linked dataset, not a copy
  • Set exchange and listing visibility to private or public
  • Use a data clean room to join data without revealing rows
  • Clean rooms enforce analysis rules and data egress controls
  • Row and column security travel with shared data
  • Share a Looker Studio report, not the dataset behind it
  • Match the sharing tool to who the consumer is and how much they may see
  • Analyze foreign-cloud data with Omni, not BigQuery sharing
  • Enable uniform bucket-level access before adding IAM Conditions on a Cloud Storage bucket
  • Hand out V4 signed URLs for time-limited access by users without Google Cloud accounts
  • Downscope a token with Credential Access Boundaries to limit it to one prefix or bucket
  • Split Analytics Hub access into Viewer (browse), Subscriber (subscribe), and Publisher (create listings)
  • Turn on Subscriber Email Logging to audit which subscribers query shared data
  • An Analytics Hub listing's dataset must live in the same region as its data exchange

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. BigQuery authorized views
  2. Share data with authorized views and authorized datasets
  3. Introduction to BigQuery sharing (Analytics Hub)
  4. BigQuery data clean rooms
  5. Introduction to BigQuery row-level security
  6. Looker Studio overview