Skip to main content
This page lists what you need in Google Cloud before connecting BigQuery to Prizm: the APIs to enable, the authentication method, and the roles to grant for each kind of metadata you want Prizm to extract.

Authentication

Choose one of the following. Both need the APIs and roles described below.

Enable the Required APIs

Enable these APIs in the host project, and in each monitored project where noted.
Enable the Data Lineage API early, in every project where jobs run. Lineage is recorded only from the time the API is enabled. There is no backfill, and Google retains lineage records for a limited period. Check Google’s Data Lineage documentation for the current retention window.

Grant the Required Roles

Grant only the roles for the features you want. Roles marked per project go on each project Prizm monitors.

Example: grant roles to a service account

Repeat for each monitored project, and add the organization- or folder-level roles (project listing, tags, JOBS_BY_ORGANIZATION) where you need them.
Prizm doesn’t create, change, or delete datasets or tables. Beyond metadata and job history, it needs to run queries (bigquery.jobs.create, covered by roles/bigquery.jobUser) and, for quality and profiling checks, to read table data (bigquery.tables.getData). For external tables, it also needs to read the storage bucket (storage.buckets.get, storage.buckets.list, storage.objects.get, storage.objects.list). Tag import needs resourcemanager.tagKeys.list, resourcemanager.tagValues.list, datacatalog.taxonomies.list, and datacatalog.taxonomies.get.

Connect BigQuery in Prizm

1

Open the connector wizard

Navigate to Source and click the + icon next to the source list. Search for BigQuery and select it from the connector grid.
2

Enter source details

The BigQuery Source Details form

BigQuery source details

3

Choose an authentication method

Select Service Account Key (the default) or Workload Identity. For a service account key, upload the JSON key file, or turn on Use Vault to retrieve it from a configured vault.
The BigQuery lineage and authentication fields with the Service Account Key upload area

Lineage mode, authentication type and service account key upload

4

Validate and choose scope

Click Next to validate the connection, then choose which datasets Prizm should catalog.
5

Save

Complete the configuration. The source then appears in the Source list, where the Valid column shows a green check for a working connection.

Next Steps

What We Collect

See what Prizm extracts from BigQuery.

FAQ

Common questions about authentication, roles, and lineage.

Troubleshooting

Diagnose connection failures, permission errors, and timeouts.