IssueTracker

This will create a public issue which anybody can view and comment on.

Problem you have encountered:

Users cannot get a list of BigQuery datasets where an account has access to without specifying a project [1, 2].

For that reason, users must use some type of script to get this list of projects beforehand such as [3]. However, [4] doesn't return those projects where the involved account has a BigQuery dataset-level access. Therefore, the script doesn't work as expected and users must manually insert the list of projects they want to use (which might miss a project where the account has access).

What you expected to happen:

[4] should return those projects where an account has BigQuery dataset-level access as well.

Steps to reproduce:

1. Grant dataset-level access to an account in project A.
2. Do not grant any project-level access role to that account in project A.
3. Execute [4] and you will not be able to observe that the account has dataset-level access in project A. Since [4] doesn't return project A, the script will not iterate in the loop.

Other information (workarounds you have tried, documentation consulted, etc):

[4] might need to be implemented as a general purpose query system, including those BigQuery-based permissions.

Thank you in advance for your assistance!

---

[1] List datasets:

https://cloud.google.com/bigquery/docs/listing-datasets#list_datasets

[2] List datasets where an account has access to:

bq ls --project_id=$project --format=prettyjson

[3] Suggested script:

#!/bin/bash

# Get a list of all projects where the account has access to
projects=$(gcloud projects list --format="value(projectId)")

for project in $projects; do

echo "Project: $project"

# List all datasets where the account has access to in the current project
datasets=$(bq ls --project_id=$project --format=prettyjson)

echo "Datasets: $datasets"

done

[4] Get list of projects where an account has access to:

gcloud projects list --format="value(projectId)