IssueTracker

Problem you have encountered:

When configuring VPC-SC for BigQuery the necessary permission bigquery.models.updateData to create TensorFlow models was not supported.

googleapi: Error 400: Invalid Directional Policies set in Perimeter 'accessPolicies/<access_policy>/servicePerimeters/<project_id>': Error in IngressTo: PERMISSION 'bigquery.models.updateData' is not supported in bigquery.googleapis.com

What you expected to happen:

The bigquery.models.updateData permission should be added to the other supported model permissions, e.g. bigquery.models.getData and bigquery.models.updateMetadata are already supported.

Steps to reproduce:

• Console

  • Edit service perimeter ingress policy
  • Try to add bigquery.models.updateData permission as selected method for BigQuery API

• gcloud

  cat > ingress.yaml <<EOF
  - ingressFrom:
      identityType: ANY_IDENTITY
      sources: [accessLevel: "*"]
    ingressTo:
      operations:
      - serviceName: bigquery.googleapis.com
        methodSelectors:
        - permission: bigquery.models.getData
        - permission: bigquery.models.updateMetadata
        - permission: bigquery.models.updateData
  EOF
  gcloud access-context-manager perimeters create bug --title=bug --restricted-services=bigquery.googleapis.com --ingress-policies=ingress.yaml
  

  ERROR: (gcloud.access-context-manager.perimeters.create) INVALID_ARGUMENT: Invalid Directional Policies set in Perimeter 'accessPolicies/67977849759/servicePerimeters/bug': Error in IngressTo: PERMISSION 'bigquery.models.updateData' is not supported in bigquery.googleapis.com

Other information (workarounds you have tried, documentation consulted, etc):

Allowing all methods and permissions seems to be a workaround, though not desirable in our use-case.