Data control language (DCL) statements in GoogleSQL

The BigQuery data control language (DCL) statements let you set upand control BigQuery resources usingGoogleSQL query syntax.

Use these statements to give or remove access to BigQuery resources.

For more information on controlling access to specific BigQuery resources,see:

• Controlling access to datasets
• Controlling access to tables
• Controlling access to views

Permissions required

The following permissions are required to runGRANT andREVOKE statements.

GRANT statement

Grants roles to users on BigQuery resources.

Syntax

GRANT role_list  ON resource_type resource_name  TOuser_list

Arguments

• role_list: A role or list of comma separated roles that contains thepermissions you want to grant. For more information on the types of roles available,seeRoles and permissions.

• resource_type: The type of resource the role is applied to. Supported values include:SCHEMA (equivalent to dataset),TABLE,VIEW,EXTERNAL TABLE.

• resource_name: The name of the resource you want to grant the permission on.

• user_list: A comma separated list of users that the role is granted to.

user_list

Specify users using the following formats:

For more information about each type of user in the table, seeConcepts related to identity.

Example

The following example grants thebigquery.dataViewer role to the usersraha@example-pet-store.com andsasha@example-pet-store.com on a dataset namedmyDataset:

GRANT`roles/bigquery.dataViewer`ONSCHEMA`myProject`.myDatasetTO"user:raha@example-pet-store.com","user:sasha@example-pet-store.com"

REVOKE statement

Removes roles from a list of users on BigQuery resources.

Syntax

REVOKE role_list  ON resource_type resource_name  FROMuser_list

Arguments

• role_list: A role or list of comma separated roles that contains thepermissions you want to remove. For more information on the types of roles available,seeRoles and permissions.

• resource_type: The type of resource that the role will be removed from. Supported values include:SCHEMA (equivalent to dataset),TABLE,VIEW,EXTERNAL TABLE.

• resource_name: The name of the resource you want to revoke the role on.

• user_list: A comma separated list of users that the role is revoked from.

Example

The following example removes thebigquery.admin role on themyDatasetdataset from theexample-team@example-pet-store.com group and a serviceaccount:

REVOKE`roles/bigquery.admin`ONSCHEMA`myProject`.myDatasetFROM"group:example-team@example-pet-store.com","serviceAccount:user@test-project.iam.gserviceaccount.com"