Create Blob Storage BigLake tables
Important: The term "BigLake" on this page refers to an accessdelegation functionality for external tables in BigQuery. Forinformation about BigLake, the stand-alone Google Cloudproduct that includes BigLake metastore, the Apache Iceberg REST catalog,and BigLake tables for Apache Iceberg seeBigLake overview.This document describes how to create an Azure Blob Storage BigLaketable. ABigLake tablelets you use access delegation to query data in Blob Storage. Accessdelegation decouples access to the BigLake table from access tothe underlying datastore.
For information about how data flows between BigQuery andBlob Storage, seeData flow when querying data.
Before you begin
Ensure that you have aconnection to access data in your Blob Storage.
Required roles
To get the permissions that you need to create an external table, ask your administrator to grant you theBigQuery Admin (roles/bigquery.admin) IAM role on your dataset. For more information about granting roles, seeManage access to projects, folders, and organizations.
This predefined role contains the permissions required to create an external table. To see the exact permissions that are required, expand theRequired permissions section:
Required permissions
The following permissions are required to create an external table:
bigquery.tables.createbigquery.connections.delegate
You might also be able to get these permissions withcustom roles or otherpredefined roles.
Create a dataset
Before you create an external table, you need to create a dataset in thesupported region. Select one ofthe following options:Console
Go to theBigQuery page.
- In the left pane, clickExplorer.
- In theExplorer pane, select the project where you want to create the dataset.
- ClickView actions, and then clickCreate dataset.
- On theCreate dataset page, specify the following details:
- ForDataset ID enter a unique datasetname.
- ForData location choose asupported region.
- Optional: To delete tables automatically, select theEnable table expiration checkbox and set theDefault maximum table age in days. Data in Azure is not deleted when the table expires.
- If you want to usedefault collation, expand theAdvanced options section and then select theEnable default collation option.
- ClickCreate dataset.
SQL
Use theCREATE SCHEMA DDL statement.The following example create a dataset in theazure-eastus2 region:
In the Google Cloud console, go to theBigQuery page.
In the query editor, enter the following statement:
CREATESCHEMAmydatasetOPTIONS(location='azure-eastus2');
ClickRun.
For more information about how to run queries, seeRun an interactive query.
bq
In a command-line environment, create a dataset using thebq mkcommand:
bq--location=LOCATIONmk\--dataset\PROJECT_ID:DATASET_NAME
The--project_id parameter overrides the default project.
Replace the following:
LOCATION: the location of your datasetFor information about supported regions, seeLocations.After youcreate a dataset, you can't change its location. You can set a defaultvalue for the location by using the
.bigqueryrcfile.PROJECT_ID: your project IDDATASET_NAME: the name of the dataset thatyou want to createTo create a dataset in a project other than your default project, add theproject ID to the dataset name in the following format:
PROJECT_ID:DATASET_NAME.
Create BigLake tables on unpartitioned data
Select one of the following options:
Console
Go to theBigQuery page.
In the left pane, clickExplorer:

If you don't see the left pane, clickExpand left pane to open the pane.
In theExplorer pane, expand your project, clickDatasets, andthen select a dataset.
In theDataset info section, clickCreate table.
On theCreate table page, in theSource section, do the following:
- ForCreate table from, selectAzure Blob Storage.
ForSelect Azure Blob Storage path, enter a Blob Storagepath using the following format:
azure://AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/CONTAINER_NAME/FILE_PATHReplace the following:
AZURE_STORAGE_ACCOUNT_NAME: The name ofthe Blob Storage account. The account's region should be the sameas the dataset's region.CONTAINER_NAME: The name of the Blob Storagecontainer.FILE_PATH: The data path that points tothe Blob Storage data. For example, for a single CSV file,FILE_PATHcan bemyfile.csv.
ForFile format, select the data format in Azure. Supported formatsareAVRO,CSV,DELTA_LAKE,ICEBERG,JSONL,ORC, andPARQUET.
In theDestination section, do the following:
- ForDataset, choose the appropriate dataset.
- In theTable field, enter the name of the table.
- Verify thatTable type is set toExternal table.
- ForConnection ID, choose the appropriate connection ID from thedrop-down. For information about connections, seeConnect toBlob Storage.
In theSchema section, you can either enableschema auto-detection or manually specifya schema if you have a source file. If you don't have a source file, youmust manually specify a schema.
To enable schema auto-detection, select theAuto-detect option.
To manually specify a schema, leave theAuto-detect optionunchecked. EnableEdit as text and enter the table schema as aJSON array.
ClickCreate table.
SQL
To create a BigLake table, use theCREATE EXTERNAL TABLEstatement with theWITH CONNECTION clause:
In the Google Cloud console, go to theBigQuery page.
In the query editor, enter the following statement:
CREATEEXTERNALTABLEDATASET_NAME.TABLE_NAMEWITHCONNECTION`AZURE_LOCATION.CONNECTION_NAME`OPTIONS(format='DATA_FORMAT',uris=['azure://AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/CONTAINER_NAME/FILE_PATH']);
Replace the following:
DATASET_NAME: the name of the dataset you createdTABLE_NAME: the name you want to give to this tableAZURE_LOCATION: an Azure location in Google Cloud, such asazure-eastus2CONNECTION_NAME: the name of the connection you createdDATA_FORMAT: any of the supportedBigQuery federated formats, such asAVRO,CSV,DELTA_LAKE, orICEBERG(preview)AZURE_STORAGE_ACCOUNT_NAME: the name of the Blob Storage accountCONTAINER_NAME: the name of the Blob Storage containerFILE_PATH: the data path that points to the Blob Storage data
ClickRun.
For more information about how to run queries, seeRun an interactive query.
Example:
CREATEEXTERNALTABLEabsdataset.abstableWITHCONNECTION`azure-eastus2.abs-read-conn`OPTIONS(format='CSV',uris=['azure://account_name.blob.core.windows.net/container/path/file.csv']);
bq
Create atable definition file:
bqmkdef\--source_format=DATA_FORMAT\--connection_id=AZURE_LOCATION.CONNECTION_NAME\"azure://AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/CONTAINER_NAME/FILE_PATH">table_def
Replace the following:
DATA_FORMAT: any of the supportedBigQuery federated formats,such asAVRO,CSV,ICEBERG, orPARQUETAZURE_LOCATION: an Azure location in Google Cloud,such asazure-eastus2CONNECTION_NAME: the name of the connection that youcreatedAZURE_STORAGE_ACCOUNT_NAME: the name of the Blob Storage accountCONTAINER_NAME: the name of the Blob Storage containerFILE_PATH: the data path that points to the Blob Storage data
Next, create the BigLake table:
bqmk--external_table_definition=table_defDATASET_NAME.TABLE_NAMEReplace the following:
DATASET_NAME: the name of the dataset that you createdTABLE_NAME: the name that you want to give to this table
For example, the following commands create a new BigLake table,my_dataset.my_table, which can query your Blob Storage data that's storedat the pathazure://account_name.blob.core.windows.net/container/path andhas a read connection in the locationazure-eastus2:
bqmkdef\--source_format=AVRO\--connection_id=azure-eastus2.read-conn\"azure://account_name.blob.core.windows.net/container/path">table_defbqmk\--external_table_definition=table_defmy_dataset.my_table
--project_id=PROJECT_ID parameter. ReplacePROJECT_ID with the ID of your Google Cloud project.API
Call thetables.insert methodAPI method, and create anExternalDataConfigurationin theTable resourcethat you pass in.
Specify theschema property or set theautodetect property totrue to enable schema auto detection forsupported data sources.
Specify theconnectionId property to identify the connection to usefor connecting to Blob Storage.
Create BigLake tables on partitioned data
You can create a BigLake table for Hive partitioned data inBlob Storage. After you create an externally partitioned table, you can'tchange the partition key. You need to recreate the table to change thepartition key.
To create a BigLake table based on Hive partitioned data,select one of the following options:
Console
Go to theBigQuery page.
In the left pane, clickExplorer:

If you don't see the left pane, clickExpand left pane to open the pane.
In theExplorer pane, expand your project, clickDatasets, andthen select a dataset.
ClickCreate table. TheCreate table pane opens.
In theSource section, specify the following details:
ForCreate table from, select one of the following options:
- Amazon S3
- Azure Blob Storage
Provide the path to the folder, usingwildcards.For example:
- For Amazon S3:
s3://mybucket/* - For Blob Storage:
azure://mystorageaccount.blob.core.windows.net/mycontainer/*
The foldermust be in the same location as the dataset that contains thetable you want to create, append, or overwrite.
- For Amazon S3:
From theFile format list, select the file type.
Select theSource data partitioning checkbox, and then specifythe following details:
- ForSelect Source URI Prefix, enter theURI prefix. For example,
s3://mybucket/my_files. - Optional: To require a partition filter on all queries for thistable, select theRequire partition filter checkbox.Requiring a partition filter can reduce cost and improveperformance. For more information, seeRequiring predicate filters on partition keys in queries.
In thePartition inference mode section, select one of thefollowing options:
- Automatically infer types: set the partition schemadetection mode to
AUTO. - All columns are strings: set the partition schemadetection mode to
STRINGS. - Provide my own: set the partition schema detection mode to
CUSTOMand manually enter the schemainformation for the partition keys. For more information, seeCustom partition key schema.
- Automatically infer types: set the partition schemadetection mode to
- ForSelect Source URI Prefix, enter theURI prefix. For example,
In theDestination section, specify the following details:
- ForProject, select the project in which you want to createthe table.
- ForDataset, select the dataset in which you want to createthe table.
- ForTable, enter the name of the table that you wantto create.
- ForTable type, verify thatExternal table is selected.
- ForConnection ID, select the connection that you createdearlier.
In theSchema section, you can either enableschema auto-detection or manually specifya schema if you have a source file. If you don't have a source file, youmust manually specify a schema.
To enable schema auto-detection, select theAuto-detect option.
To manually specify a schema, leave theAuto-detect optionunchecked. EnableEdit as text and enter the table schema as aJSON array.
To ignore rows with extra column values that don't match the schema,expand theAdvanced options section and selectUnknown values.
ClickCreate table.
SQL
Use theCREATE EXTERNAL TABLE DDL statement:
In the Google Cloud console, go to theBigQuery page.
In the query editor, enter the following statement:
CREATEEXTERNALTABLE`PROJECT_ID.DATASET.EXTERNAL_TABLE_NAME`WITHPARTITIONCOLUMNS(PARTITION_COLUMNPARTITION_COLUMN_TYPE,)WITHCONNECTION`PROJECT_ID.REGION.CONNECTION_ID`OPTIONS(hive_partition_uri_prefix="HIVE_PARTITION_URI_PREFIX",uris=['FILE_PATH'],format="TABLE_FORMAT");
Replace the following:
PROJECT_ID: the name of your project in which you want to create the table—for example,myprojectDATASET: the name of the BigQuery dataset that you want to create the table in—for example,mydatasetEXTERNAL_TABLE_NAME: the name of the table that you want to create—for example,mytablePARTITION_COLUMN: the name of the partitioning columnPARTITION_COLUMN_TYPE: the type of the partitioning columnREGION: the region that contains the connection—for example,usCONNECTION_ID: the name of the connection—for example,myconnectionHIVE_PARTITION_URI_PREFIX: hive partitioninguri prefix–for example:s3://mybucket/azure://mystorageaccount.blob.core.windows.net/mycontainer/
FILE_PATH: path to the data source for the external table that you want to create—for example:s3://mybucket/*.parquetazure://mystorageaccount.blob.core.windows.net/mycontainer/*.parquet
TABLE_FORMAT: the format of the table that you want to create—for example,PARQUET
ClickRun.
For more information about how to run queries, seeRun an interactive query.
Examples
The following example creates a BigLake table overpartitioned data in Amazon S3. The schema is autodetected.
CREATEEXTERNALTABLE`my_dataset.my_table`WITHPARTITIONCOLUMNS(skuSTRING,)WITHCONNECTION`us.my-connection`OPTIONS(hive_partition_uri_prefix="s3://mybucket/products",uris=['s3://mybucket/products/*']);
The following example creates a BigLake table overpartitioned data in Blob Storage. The schema is specified.
CREATEEXTERNALTABLE`my_dataset.my_table`(ProductIdINTEGER,ProductName,STRING,ProductType,STRING)WITHPARTITIONCOLUMNS(skuSTRING,)WITHCONNECTION`us.my-connection`OPTIONS(hive_partition_uri_prefix="azure://mystorageaccount.blob.core.windows.net/mycontainer/products",uris=['azure://mystorageaccount.blob.core.windows.net/mycontainer/*']);
bq
First, use thebq mkdef command tocreate a table definition file:
bqmkdef\--source_format=SOURCE_FORMAT\--connection_id=REGION.CONNECTION_ID\--hive_partitioning_mode=PARTITIONING_MODE\--hive_partitioning_source_uri_prefix=URI_SHARED_PREFIX\--require_hive_partition_filter=BOOLEAN\URIS>DEFINITION_FILE
Replace the following:
SOURCE_FORMAT: the format of the external datasource. For example,CSV.REGION: the region that contains theconnection—for example,us.CONNECTION_ID: the name of the connection—forexample,myconnection.PARTITIONING_MODE: the Hive partitioning mode. Use one of thefollowing values:AUTO: Automatically detect the key names and types.STRINGS: Automatically convert the key names to strings.CUSTOM: Encode the key schema in the source URI prefix.
URI_SHARED_PREFIX: the source URI prefix.BOOLEAN: specifies whether to require a predicate filter at querytime. This flag is optional. The default value isfalse.URIS: the path to the Amazon S3 or theBlob Storage folder, usingwildcard format.DEFINITION_FILE: the path to thetable definition file on your localmachine.
IfPARTITIONING_MODE isCUSTOM, include the partition key schemain the source URI prefix, using the following format:
--hive_partitioning_source_uri_prefix=GCS_URI_SHARED_PREFIX/{KEY1:TYPE1}/{KEY2:TYPE2}/...
After you create the table definition file, use thebq mk command tocreate the BigLake table:
bqmk--external_table_definition=DEFINITION_FILE\DATASET_NAME.TABLE_NAME\SCHEMA
Replace the following:
DEFINITION_FILE: the path to the table definition file.DATASET_NAME: the name of the dataset that contains thetable.TABLE_NAME: the name of the table you're creating.SCHEMA: specifies a path to aJSON schema file,or specifies the schema in the formfield:data_type,field:data_type,.... To use schemaauto-detection, omit this argument.
Examples
The following example usesAUTO Hive partitioning mode for Amazon S3data:
bq mkdef --source_format=CSV \ --connection_id=us.my-connection \ --hive_partitioning_mode=AUTO \ --hive_partitioning_source_uri_prefix=s3://mybucket/myTable \ --metadata_cache_mode=AUTOMATIC \ s3://mybucket/* > mytable_defbq mk --external_table_definition=mytable_def \ mydataset.mytable \ Region:STRING,Quarter:STRING,Total_sales:INTEGERThe following example usesSTRING Hive partitioning mode for Amazon S3data:
bq mkdef --source_format=CSV \ --connection_id=us.my-connection \ --hive_partitioning_mode=STRING \ --hive_partitioning_source_uri_prefix=s3://mybucket/myTable \ s3://mybucket/myTable/* > mytable_defbq mk --external_table_definition=mytable_def \ mydataset.mytable \ Region:STRING,Quarter:STRING,Total_sales:INTEGERThe following example usesCUSTOM Hive partitioning mode forBlob Storage data:
bq mkdef --source_format=CSV \ --connection_id=us.my-connection \ --hive_partitioning_mode=CUSTOM \ --hive_partitioning_source_uri_prefix=azure://mystorageaccount.blob.core.windows.net/mycontainer/{dt:DATE}/{val:STRING} \ azure://mystorageaccount.blob.core.windows.net/mycontainer/* > mytable_defbq mk --external_table_definition=mytable_def \ mydataset.mytable \ Region:STRING,Quarter:STRING,Total_sales:INTEGERAPI
To set Hive partitioning using the BigQuery API, include thehivePartitioningOptionsobject in theExternalDataConfigurationobject when you create thetable definition file.To create a BigLake table, you must also specify a valuefor theconnectionId field.
If you set thehivePartitioningOptions.mode field toCUSTOM, you mustencode the partition key schema in thehivePartitioningOptions.sourceUriPrefix field as follows:s3://BUCKET/PATH_TO_TABLE/{KEY1:TYPE1}/{KEY2:TYPE2}/...
To enforce the use of a predicate filter at query time, set thehivePartitioningOptions.requirePartitionFilter field totrue.
Delta Lake tables
Delta Lake is an open source table format that supports petabyte scale datatables. Delta Lake tables can be queried as both temporary and permanent tables,and is supported as aBigLaketable.
Schema synchronization
Delta Lake maintains a canonical schema as part of its metadata. Youcan't update a schema using a JSON metadata file. To update the schema:
Use the
bq updatecommandwith the--autodetect_schemaflag:bq update --autodetect_schemaPROJECT_ID:DATASET.TABLE
Replace the following:
PROJECT_ID: the project ID containing the table that youwant to updateDATASET: the dataset containing the table that youwant to updateTABLE: the table that you want to update
Type conversion
BigQuery converts Delta Lake data types to the followingBigQuery data types:
| Delta Lake Type | BigQuery Type |
|---|---|
boolean | BOOL |
byte | INT64 |
int | INT64 |
long | INT64 |
float | FLOAT64 |
double | FLOAT64 |
Decimal(P/S) | NUMERIC orBIG_NUMERIC depending on precision |
date | DATE |
time | TIME |
timestamp (not partition column) | TIMESTAMP |
timestamp (partition column) | DATETIME |
string | STRING |
binary | BYTES |
array<Type> | ARRAY<Type> |
struct | STRUCT |
map<KeyType, ValueType> | ARRAY<Struct<key KeyType, value ValueType>> |
Limitations
The following limitations apply to Delta Lake tables:
External table limitations applyto Delta Lake tables.
Delta Lake tables are only supported onBigQuery Omni and have the associatedlimitations.
You can't update a table with a new JSON metadata file. You must use an autodetect schema table update operation. SeeSchemasynchronization for more information.
BigLake security features only protect Delta Laketables when accessed through BigQuery services.
Create a Delta Lake table
The following example creates an external table by using theCREATE EXTERNALTABLEstatement with theDelta Lake format:
CREATE [OR REPLACE] EXTERNAL TABLEtable_nameWITH CONNECTIONconnection_nameOPTIONS ( format = 'DELTA_LAKE', uris = ["parent_directory"] );
Replace the following:
table_name: The name of the table.
connection_name: The name of the connection. The connection mustidentify either anAmazon S3 or aBlob Storage source.
parent_directory: The URI of the parent directory.
Cross-cloud transfer with Delta Lake
The following example uses theLOAD DATAstatement to load data to the appropriate table:
LOAD DATA [INTO | OVERWRITE]table_nameFROM FILES ( format = 'DELTA_LAKE', uris = ["parent_directory"])WITH CONNECTIONconnection_name;
For more examples of cross-cloud data transfers, seeLoad data with cross cloudoperations.
Query BigLake tables
For more information, seeQuery Blob Storage data.
View resource metadata withINFORMATION_SCHEMA
Preview
This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of theService Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see thelaunch stage descriptions.
You can view the resource metadata withINFORMATION_SCHEMA views. When you query theJOBS_BY_*,JOBS_TIMELINE_BY_*, andRESERVATION*views, you mustspecify the query's processing locationthat is collocated with the table's region. For information about BigQuery Omnilocations, seeLocations. For allother system tables, specifying the query job location isoptional.
For information about the system tables that BigQuery Omni supports, seeLimitations.
To queryJOBS_* andRESERVATION* system tables, select one of the followingmethods to specify the processing location:
Console
Go to theBigQuery page.
If theEditor tab isn't visible, then clickCompose new query.
ClickMore>Query settings. TheQuery settingsdialog opens.
In theQuery settings dialog, forAdditional settings>Data location, select theBigQuery regionthat is collocated with the BigQuery Omni region.For example, if your BigQuery Omni region is
aws-us-east-1,specifyus-east4.Select the remaining fields and clickSave.
bq
Use the--location flag to set the job's processing location to theBigQuery region that iscollocated with the BigQuery Omni region.For example, if your BigQuery Omni region isaws-us-east-1,specifyus-east4.
Example
bqquery--use_legacy_sql=false--location=us-east4\"SELECT * FROM region-azure-eastus2.INFORMATION_SCHEMA.JOBS limit 10;"API
If you arerunning jobs programmatically,set the location argument to theBigQuery regionthat is collocated with the BigQuery Omni region.For example, if your BigQuery Omni region isaws-us-east-1,specifyus-east4.
VPC Service Controls
You can use VPC Service Controls perimeters to restrict access fromBigQuery Omni to an external cloud service as an extra layer ofdefense. For example, VPC Service Controls perimeters can limit exports fromyour BigQuery Omni tables to a specific Amazon S3 bucketor Blob Storage container.
To learn more about VPC Service Controls, seeOverview of VPC Service Controls.
Required permission
Ensure that you have the required permissions to configure service perimeters.To view a list of IAM roles required toconfigure VPC Service Controls, seeAccess control withIAM in theVPC Service Controls documentation.
Set up VPC Service Controls using the Google Cloud console
In the Google Cloud console navigation menu, clickSecurity, and then clickVPC Service Controls.
To set up VPC Service Controls for BigQuery Omni, follow the steps in theCreate a service perimeter guide, and when you are in theEgress rules pane, follow these steps:
In theEgress rules panel, clickAdd rule.
In theFrom attributes of the API client section, select an optionfrom theIdentity list.
SelectTo attributes of external resources.
To add an external resource, clickAdd external resources.
In theAdd external resource dialog, forExternal resource name,enter a valid resource name. For example:
For Amazon Simple Storage Service (Amazon S3):
s3://BUCKET_NAMEReplaceBUCKET_NAME with the name of your Amazon S3 bucket.
For Azure Blob Storage:
azure://myaccount.blob.core.windows.net/CONTAINER_NAMEReplaceCONTAINER NAME with the name of your Blob Storagecontainer.
For a list of egress rule attributes, seeEgress rules reference.
Select the methods that you want to allow on your external resources:
- If you want to allow all methods, selectAll methods in theMethods list.
- If you want to allow specific methods, selectSelected method,clickSelect methods, and then select the methods that youwant to allow on your external resources.
ClickCreate perimeter.
Set up VPC Service Controls using the gcloud CLI
To set up VPC Service Controls using the gcloud CLI, follow thesesteps:
Set the default access policy
An access policy is an organization-wide containerfor access levels and service perimeters. For information about setting adefault access policy or getting an access policy name, seeManaging an accesspolicy.
Create the egress policy input file
An egress rule block defines the allowed access from within a perimeter to resourcesoutside of that perimeter. For external resources, theexternalResources propertydefines the external resource paths allowed access from within yourVPC Service Controls perimeter.
Egress rules can be configured usinga JSON file, or a YAML file. The following sample uses the.yaml format:
-egressTo:operations:-serviceName:bigquery.googleapis.commethodSelectors:-method:"*"*OR*-permission:"externalResource.read"externalResources:-EXTERNAL_RESOURCE_PATHegressFrom:identityType:IDENTITY_TYPE*OR*identities:-serviceAccount:SERVICE_ACCOUNT
egressTo: lists allowed service operations on Google Cloud resourcesin specified projects outside the perimeter.operations: list accessible services and actions or methods that aclient satisfying thefromblock conditions is allowed to access.serviceName: setbigquery.googleapis.comfor BigQuery Omni.methodSelectors: list methods that a client satisfying thefromconditionscan access. For restrictable methods and permissions for services, seeSupported service method restrictions.method: a valid service method, or\"*\"to allow allserviceNamemethods.permission: a valid service permission, such as\"*\",externalResource.read, orexternalResource.write. Access to resourcesoutside the perimeter is allowed for operations that require this permission.externalResources: lists external resources that clients inside a perimetercan access. ReplaceEXTERNAL_RESOURCE_PATH with either a validAmazon S3 bucket, such ass3://bucket_name, or aBlob Storage container path, such asazure://myaccount.blob.core.windows.net/container_name.egressFrom: lists allowed service operations on Google Cloudresources in specified projects within the perimeter.identityTypeoridentities: defines the identity types that can access thespecified resources outside the perimeter. ReplaceIDENTITY_TYPEwith one of the following valid values:ANY_IDENTITY: to allow all identities.ANY_USER_ACCOUNT: to allow all users.ANY_SERVICE_ACCOUNT: to allow all service accounts
identities: lists service accounts that can access the specified resourcesoutside the perimeter.serviceAccount(optional): replaceSERVICE_ACCOUNT with theservice account that can access the specified resources outside theperimeter.
Examples
The following example is a policy that allows egress operations from inside theperimeter to thes3://mybucket Amazon S3 location in AWS.
-egressTo:operations:-serviceName:bigquery.googleapis.commethodSelectors:-method:"*"externalResources:-s3://mybucket-s3://mybucket2egressFrom:identityType:ANY_IDENTITY
The following example allows egress operations to a Blob Storage container:
-egressTo:operations:-serviceName:bigquery.googleapis.commethodSelectors:-method:"*"externalResources:-azure://myaccount.blob.core.windows.net/mycontaineregressFrom:identityType:ANY_IDENTITY
For more information about egress policies, see theEgress rules reference.
Add the egress policy
To add the egress policy when you create a new service perimeter, use thegcloud access-context-manager perimeters create command.For example, the following command creates a newperimeter namedomniPerimeter that includes the project with project number12345, restricts the BigQuery API, and adds an egress policydefined in theegress.yaml file:
gcloudaccess-context-managerperimeterscreateomniPerimeter\--title="Omni Perimeter"\--resources=projects/12345\--restricted-services=bigquery.googleapis.com\--egress-policies=egress.yaml
To add the egress policy to an existing service perimeter, use thegcloud access-context-manager perimeters update command.For example, the following command adds an egress policy defined in theegress.yaml file to an existing service perimeter namedomniPerimeter:
gcloudaccess-context-managerperimetersupdateomniPerimeter--set-egress-policies=egress.yamlVerify your perimeter
To verify the perimeter, use thegcloud access-context-manager perimeters describe command:
gcloudaccess-context-managerperimetersdescribePERIMETER_NAME
ReplacePERIMETER_NAME with the name of the perimeter.
For example, the following command describes the perimeteromniPerimeter:
gcloudaccess-context-managerperimetersdescribeomniPerimeter
For more information, seeManaging service perimeters.
Allow BigQuery Omni VPC access to Blob Storage
As a BigQuery administrator, you can create a network rule togrant BigQuery Omni access to your Blob Storage resources.This ensures that only authorized BigQuery Omni VPCs can interact withyour Blob Storage, enhancing the security of your data.
Apply a network rule for BigQuery Omni VPC
To apply a network rule, use the Azure PowerShell or Terraform:
Azure PowerShell
Run the following command to add a network rule to your storage account thatspecifies the retrieved BigQuery Omni subnet IDs as theVirtualNetworkResourceId.
Add-AzStorageAccountNetworkRule`-ResourceGroupName"RESOURCE_GROUP_NAME"`-Name"STORAGE_ACCOUNT_NAME"`-VirtualNetworkResourceId"SUBNET_ID1","SUBNET_ID2"
Replace the following:
RESOURCE_GROUP_NAME: the resource group name.STORAGE_ACCOUNT_NAME: the storage account name.SUBNET_ID1,SUBNET_ID1:the subnet IDs. You can find this information in the table on this page.
Terraform
Add the following to your Terraform configuration file:
resource"azurerm_storage_account_network_rules""example"{storage_account_name="STORAGE_ACCOUNT_NAME"resource_group_name="RESOURCE_GROUP_NAME"default_action="Allow"bypass=["Logging", "Metrics", "AzureServices"]virtual_network_subnet_ids=["SUBNET_ID1","SUBNET_ID2"]}
Replace the following:
STORAGE_ACCOUNT_NAME: the storage account name.RESOURCE_GROUP_NAME: the resource group name.SUBNET_ID1,SUBNET_ID1:the subnet IDs. You can find this information in the table on this page.
BigQuery Omni VPC Resource IDs
| Region | Subnet IDs |
|---|---|
| azure-eastus2 | /subscriptions/95f30708-58d1-48ba-beac-d71870c3b2f5/resourceGroups/bqe-prod-eastus2-resource-group/providers/Microsoft.Network/virtualNetworks/bqe-prod-eastus2-network/subnets/azure-prod-eastus21-yurduaaaaa-private /subscriptions/95f30708-58d1-48ba-beac-d71870c3b2f5/resourceGroups/bqe-prod-eastus2-resource-group/providers/Microsoft.Network/virtualNetworks/bqe-prod-eastus2-network/subnets/azure-prod-eastus22-yurduaaaab-private |
Limitations
For a full list of limitations that apply to BigLake tablesbased on Amazon S3 and Blob Storage, seeLimitations.
What's next
- Learn aboutBigQuery Omni.
- Learn aboutBigLake tables.
- Learn how toexport query results to Blob Storage.
Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-12-15 UTC.