BigQuery
Connect a Google BigQuery project to trend with a read-only service account.
trend connects to BigQuery via a Google Cloud service account with read-only IAM roles. Unlike a database with usernames, BigQuery's read-only-ness is enforced by which IAM roles you grant the service account — you do not need (or want) roles/bigquery.admin.
Recommended service-account setup
Run these commands in the gcloud CLI, signed in as an owner of the project you want to bill for query jobs.
export PROJECT=your-project-id
gcloud iam service-accounts create trend-readonly \
--project=$PROJECT \
--display-name="trend read-only"
# Read table + view contents
gcloud projects add-iam-policy-binding $PROJECT \
--member="serviceAccount:trend-readonly@$PROJECT.iam.gserviceaccount.com" \
--role="roles/bigquery.dataViewer"
# Run query jobs (billed to $PROJECT)
gcloud projects add-iam-policy-binding $PROJECT \
--member="serviceAccount:trend-readonly@$PROJECT.iam.gserviceaccount.com" \
--role="roles/bigquery.jobUser"
# Download the JSON key
gcloud iam service-accounts keys create key.json \
--iam-account=trend-readonly@$PROJECT.iam.gserviceaccount.com
You can also do this through the GCP console: IAM & Admin → Service Accounts → Create, then grant the same two roles and download a JSON key.
Tip
These two roles are the minimum. dataViewer never allows writes, so you don't need a "read-only" toggle anywhere — the SA is structurally incapable of running INSERT, UPDATE, DELETE, CREATE TABLE, etc.
Adding the connection
Connections → New connection → BigQuery. Enter:
- Billing project ID — the project where you granted the roles (query jobs are billed here)
- Location — optional. Set
US,EU, or a regional code (asia-southeast1) if your data lives in a specific region. If you leave it blank, BigQuery infers the location from the datasets your queries reference. - Service account JSON key — paste the entire JSON blob. Encrypted at rest with AES-256-GCM.
- Extra datasets to sync — optional. See below.
Click Test connection. On success you'll see the green Read-only verified badge — for BigQuery, verification means the JSON key authenticates against the billing project. Read-only enforcement is the IAM role you granted, not a session flag.
Querying data across projects
BigQuery bills the job against your billing project, but queries can read data owned by any other project the service account has access to. The classic example is Google's public datasets:
SELECT product_id, name, category, retail_price
FROM `bigquery-public-data.thelook_ecommerce.products`
LIMIT 100
Fully-qualified BigQuery table names have three parts — project.dataset.table — and always need backtick-quoting because they can contain hyphens.
Extra datasets
trend's schema browser auto-discovers every dataset your billing project owns. But BigQuery INFORMATION_SCHEMA is scoped to a single dataset, so we can't auto-discover datasets in other projects (public data, cross-project shares).
Use the Extra datasets to sync field to explicitly include them. It accepts a comma or whitespace separated list of project.dataset pairs:
bigquery-public-data.thelook_ecommerce, other-team-project.marketing
If a dataset in the list turns out to be inaccessible to the service account, we silently skip it — the sync still succeeds for the rest.