Google BigQuery

Google BigQuery is Google Cloud’s serverless data warehouse. Fresco BI signs in with a service account key, lists the datasets, tables and views of the projects you name, and imports the tables you pick into a Data Table.

Feature	Supported
Import	Yes
DirectQuery	No
SSL/TLS	Always on (verified)
SSH tunnel	No
Cloud	Yes
On-premises (via Gateway)	No

Prerequisites

• A Google Cloud project with BigQuery. Its project ID (not the project name) is used for billing.
• Permission to create service accounts and keys and to grant IAM roles in that project (for example Owner or Project IAM Admin plus Service Account Admin).
• The project IDs of any other projects whose datasets Fresco BI should read.

Step 1: Create a read-only service account

Fresco BI needs three roles. Grant nothing else.

Role	Where	Why
BigQuery Data Viewer	Each dataset or project to read	List datasets and tables, read data
BigQuery Job User	Billing project	Run query jobs (views, cost dry runs)
BigQuery Read Session User	Billing project	Fast reads through the Storage Read API

In the Google Cloud console:

1. Go to IAM & Admin › Service Accounts in the billing project and click Create service account. Name it fresco-reader.
2. Grant it BigQuery Job User and BigQuery Read Session User on the project.
3. Grant BigQuery Data Viewer: on the whole project, or only on chosen datasets (dataset › Sharing › Permissions). For each other data project, grant it there too.
4. Open the service account › Keys › Add key › Create new key, choose JSON and download the file.

Or with the gcloud CLI:

gcloud iam service-accounts create fresco-reader --project=<billing-project>
SA=fresco-reader@<billing-project>.iam.gserviceaccount.com
for ROLE in roles/bigquery.jobUser roles/bigquery.readSessionUser roles/bigquery.dataViewer; do
  gcloud projects add-iam-policy-binding <billing-project> \
    --member="serviceAccount:$SA" --role="$ROLE"
done
gcloud iam service-accounts keys create key.json --iam-account="$SA"

Keep the key file secret and delete your local copy after you paste it into Fresco BI. The key is stored encrypted and never shown again.

Step 2: Allow network access

Nothing to open. Fresco BI calls Google’s public APIs (bigquery.googleapis.com, bigquerystorage.googleapis.com, oauth2.googleapis.com) over HTTPS on port 443. BigQuery has no On-premises (via Gateway) or SSH tunnel option.

Step 3: Fill in the form

Field	What to enter
Service account key (JSON)	The whole content of the downloaded key file
Billing project ID	Project that pays for query jobs. Empty uses the key’s own project_id
Data project IDs	Up to 20 other projects whose datasets to list (each once)
Location	Dataset location, for example US, EU or asia-southeast1. Optional
Maximum bytes billed (GB)	Cost guard per table read, 1–1024 (default 10)
Use the Storage Read API	On by default; faster reads of tables

The key must be a service account key ("type": "service_account") for Google’s standard endpoints. Keys from other key types or other universes are refused.

Fresco BI lists datasets only in the billing project and the data projects you enter. Click Test connection: it lists one dataset in the billing project. Then click Save. After saving, Fresco BI shows the service account email, never the key.

How the cost guard works

• Tables read through the Storage Read API: the table’s full size must be under the limit.
• Views, external tables, or reads with the Storage Read API off: Fresco BI runs a dry run first and stops if the estimate is over the limit; the query job also carries the limit.

Troubleshooting

• The connection settings are not valid: check the marked fields. The key is not valid JSON, is not a service account key, or its private key is damaged; download a new JSON key. This also shows when billing is not enabled on the billing project, or the Location does not match the datasets.
• The server rejected the user name or password. The key was deleted or disabled, or the service account was removed. Create a new key.
• The database user cannot read this object. The service account lacks BigQuery Data Viewer on that dataset, or Job User / Read Session User on the billing project. Add the role from Step 1.
• The database or object was not found on the server. The project is not in Billing project ID or Data project IDs, or the dataset or table was deleted or renamed.
• A size or concurrent-connection limit was exceeded. The table or query is larger than Maximum bytes billed (raise it), the query answer was too large, or the BigQuery quota or rate limit was still hit after three retries (try later).
• The server did not answer in time. Usually a firewall that drops packets, or a wrong host or port. The query job ran too long. Import fewer columns or rows, or try again when the project is less busy.
• No connection could be opened to this host and port. Check the host, the port, and that the firewall allows Fresco BI’s IP. Google’s APIs could not be reached. Try again later.
• The source returned a data type this connector does not support. BYTES, GEOGRAPHY, STRUCT (RECORD), RANGE and INTERVAL columns cannot be imported; leave them out of the Data Table.