Check ID: bigquery_dataset_public_access
Provider: GCP
Service: bigquery
Severity: HIGH
Categories: internet-exposed, identity-access
Resource type: bigquery.googleapis.com/Dataset

​
What this check verifies

BigQuery datasets are evaluated for exposure to public identities. The finding highlights datasets that grant any role to allUsers or allAuthenticatedUsers, which makes the dataset publicly accessible beyond intended principals.

​
Risk

Public dataset access erodes confidentiality by enabling unrestricted reads and metadata discovery. Attackers can query and copy data for exfiltration and use schema details for lateral movement. It can also trigger unexpected costs from abusive or high-volume queries.

​
Recommendation

Apply least privilege on datasets:
  • Remove allUsers and allAuthenticatedUsers
  • Grant access only to required groups or service accounts
  • Use authorized views or controlled listings for sharing
  • Review access regularly and enforce org policies that block public identities for defense in depth

​
Remediation

# Ensure the dataset is not public by removing public principals from IAM (authoritative for this role)
resource "google_bigquery_dataset_iam_binding" "<example_resource_name>" {
  dataset_id = "<example_resource_id>"
  role       = "roles/bigquery.dataViewer"
  members    = [
    "user:<example_user_email>" # CRITICAL: exclude allUsers/allAuthenticatedUsers to remove public access
  ]
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = bigquery_dataset_public_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks