Use of Google Compute Engine service account for an easy BigQuery access
- Dominant language
- Clojure
- Stars
- 49.3k
- Forks
- 6.8k
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 653
Description
**Is your feature request related to a problem? Please describe.**
Presently, an access to a BigQuery database can only be made with a generated service account that has to be manually uploaded.
Unfortunately, this poses a security risk as the service account file has to be downloaded locally and re-uploaded to a virtual machine.
Besides, as the location of the VM is also located inside a Google Cloud Platform project, the integration could be cleaner if Metabase could find and use the [service account already]() in use in the Google Compute Engine virtual machine to access the BigQuery database.
**Describe the solution you'd like**
* Enable a further Credentials function (for example [here]()) to enable the use of an existing Google Compute Engine.
* Update the interface in the administration panel when adding a new BigQuery Database.
* Enable a further option to set the GCE service account as default GCE service account when adding the first BigQuery database.
**How important is this feature to you?**
We want to limit the attack surface to our BigQuery database.
Contributor guide
Research direction
Start with the linked BigQueryDatabase.java example and trace Metabase's BigQuery credential and administration-panel flows. Define the GCE service-account option, including the default choice for the first BigQuery database, and verify that a VM's existing account can authenticate without an uploaded key file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- google-cloud
- Domain
- backend, cloud, databases
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100