IssueTracker

When creating a Notebook instance, using the option for single-user enables the user to log into the instance (and restricts other users from doing so), but queries to external sources such as BigQuery, etc. are still sent as the instance service account rather than the logged-in user. There is an obvious workaround to utilize an OAuth pattern for the user to send their query with a valid token, therefore running the query as "themselves", but this is cumbersome for each user to need to include this functionality in their code when they have already authenticated as themselves via logging in via the proxy.

We would like to see the queries to external sources made on behalf of the user that is logged into the Notebook instance, enabling IAM permissions at the data source endpoints that correspond to the user and creating a more first-class experience for the user that is logged in. This would also ensure we do not need to either provide a workaround through "alias" service accounts tied to each user which the instance runs as nor burden our users with needing to perform the same OAuth workaround each and every time they need an ad-hoc notebook instance.

Thank you!