IssueTracker

BigQuery RLS access policies can currently only be managed through DDL statements. This makes them very challenging to manage properly in an automated environment.

Having those policies available as standard API objects would allow to simplify automation and make access policies manageable via tools such as Terraform.

Problem you have encountered:

• Making sure RLS access policies are correctly applied whenever a BQ table is created/truncated through automation is a challenge

Steps to reproduce:

• Use Infrastructure as Code to manage a table with Row Access Policies

Current workarounds:

• We currently need to detect whenever a table is changed (created / truncated) and orchestrate the execution of follow-up query jobs in order to (re)apply row access policies properly

What you expected to happen:

• Have RLS access policies manageable as separate API objects would facilitate this orchestration

This issue combined with issue #211981651 are the two main challenges we currently face when considering RLS on BigQuery.