metabase / metabase/metabase

Use of Google Compute Engine service account for an easy BigQuery access

Open
#19,941 5 comments 2 reactions 0 assignees View on GitHub
.Security related Administration/Databases Database/BigQuery Operation/ Type:New Feature
Dominant language
Clojure
Stars
49.3k
Forks
6.8k
Avg merge
1d 13h
Merged PRs (30d)
653

Description

**Is your feature request related to a problem? Please describe.**
Presently, an access to a BigQuery database can only be made with a generated service account that has to be manually uploaded.
Unfortunately, this poses a security risk as the service account file has to be downloaded locally and re-uploaded to a virtual machine.
Besides, as the location of the VM is also located inside a Google Cloud Platform project, the integration could be cleaner if Metabase could find and use the [service account already]() in use in the Google Compute Engine virtual machine to access the BigQuery database.

**Describe the solution you'd like**

* Enable a further Credentials function (for example [here]()) to enable the use of an existing Google Compute Engine.
* Update the interface in the administration panel when adding a new BigQuery Database.
* Enable a further option to set the GCE service account as default GCE service account when adding the first BigQuery database.

**How important is this feature to you?**
We want to limit the attack surface to our BigQuery database.

Contributor guide

Open the contributing guide

Research direction

Start with the linked BigQueryDatabase.java example and trace Metabase's BigQuery credential and administration-panel flows. Define the GCE service-account option, including the default choice for the first BigQuery database, and verify that a VM's existing account can authenticate without an uploaded key file.

Written by the indexing model from the issue text.

Assessment

Tech stack
google-cloud
Domain
backend, cloud, databases
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.