What's changed: Created Associate Data Practitioner Chapter 4 (Domain 4 "Data management": access control and governance = IAM least privilege/predefined roles/Cloud Storage uniform access/Analytics Hub; lifecycle management = storage classes/lifecycle rules/BigQuery expiration; HA/DR and security = backup/recovery/replication/primary-secondary location/CMEK-CSEK-GMEK/Cloud KMS/encryption at rest-in transit).
4.1Access control and governance
Understand enforcing least privilege with IAM, the difference among basic roles, predefined roles, and permissions for data services (BigQuery, Cloud Storage), Cloud Storage access control (public/private, uniform access), and when to share data securely with Analytics Hub.
Without proper governance, data risks leakage and misuse. The center of access control is IAM and per-service access settings.
4.1.1IAM and roles for data services
Grant data access with least privilege via IAM. Roles include overly broad basic roles (Viewer/Editor/Owner) and per-service predefined roles (e.g., BigQuery Data Viewer, Storage Object Viewer), combined with fine-grained permissions as needed. For data services, the basics are mindful of "who gets which dataset/bucket, read or write," granting predefined roles with least privilege.
4.1.2Cloud Storage access and Analytics Hub
In Cloud Storage, control object access as public or private, and prefer uniform bucket-level access for simpler, safer permission management (easier than per-object ACLs). To securely share data with other organizations internally or externally, use Analytics Hub to share/subscribe to BigQuery datasets without making copies. Map "uniform access over per-object ACLs" and "secure data sharing = Analytics Hub."
Common: requirement → means. E.g., "least privilege on data" = predefined roles via IAM; "allow read only" = predefined roles like BigQuery Data Viewer; "simple, safe bucket permissions" = uniform bucket-level access; "share data with other orgs without copies" = Analytics Hub.
Watch the mix-ups: (1) for data too, avoid basic roles; use predefined/least privilege. (2) Uniform bucket-level access is preferred over per-object ACLs. (3) Analytics Hub shares data without copies (subscribers reference it).
For data governance, Knowledge Catalog (renamed from Dataplex Universal Catalog in April 2026; formerly Dataplex) is also central. It manages data distributed across Cloud Storage, BigQuery, and more as logical lakes/zones, unifying automatic metadata cataloging, data-quality checks, lifecycle, and access control—helping discover and govern siloed data.
4.1.3Section summary
- Least privilege via IAM; use predefined roles (e.g., BigQuery Data Viewer) for data services
- Cloud Storage = public/private + uniform bucket-level access for simpler, safer management
- Secure cross-org data sharing via Analytics Hub (no copies)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To allow only read access to a BigQuery dataset, which role is most appropriate?
Q2. To keep Cloud Storage bucket permissions simple and safe, which approach is recommended?
Q3. To securely share a BigQuery dataset with other organizations without making copies, which is best?
Q4. What is the basic principle when designing data access?
Q5. Which should be avoided in data-service access design?
Q6. Which best describes a key benefit of Analytics Hub?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.