What's changed: Created Associate Data Practitioner Chapter 4 (Domain 4 "Data management": access control and governance = IAM least privilege/predefined roles/Cloud Storage uniform access/Analytics Hub; lifecycle management = storage classes/lifecycle rules/BigQuery expiration; HA/DR and security = backup/recovery/replication/primary-secondary location/CMEK-CSEK-GMEK/Cloud KMS/encryption at rest-in transit).
4.1Access control and governance
Understand enforcing least privilege with IAM, the difference among basic roles, predefined roles, and permissions for data services (BigQuery, Cloud Storage), Cloud Storage access control (public/private, uniform access), and when to share data securely with Analytics Hub.
Without proper governance, data risks leakage and misuse. The center of access control is IAM and per-service access settings.
4.1.1IAM and roles for data services
Grant data access with least privilege via IAM. Roles include overly broad basic roles (Viewer/Editor/Owner) and per-service predefined roles (e.g., BigQuery Data Viewer, Storage Object Viewer), combined with fine-grained permissions as needed. For data services, the basics are mindful of "who gets which dataset/bucket, read or write," granting predefined roles with least privilege.
4.1.2Cloud Storage access and Analytics Hub
In Cloud Storage, control object access as public or private, and prefer uniform bucket-level access for simpler, safer permission management (easier than per-object ACLs). To securely share data with other organizations internally or externally, use Analytics Hub to share/subscribe to BigQuery datasets without making copies. Map "uniform access over per-object ACLs" and "secure data sharing = Analytics Hub."
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.