Security, governance, and VPC Service Controls

Protect your BigQuery data in Data Studio by using VPC Service Controls and service accounts. You can enforce IP-based access levels and configure dedicated credentials that support automated reporting.

Support for VPC Service Controls

Data Studio can connect securely to BigQuery projects that are protected by VPC Service Controls (VPC-SC) perimeters. The connector passes the report viewer's end-user IP address to BigQuery, allowing Google Cloud to enforce any configured viewer IP-based access levels.

Important limitation for automated offline processes behind VPC Service Controls

By default, automated background deliveries—such as scheduled email snapshots, threshold alerts, and scheduled data extracts—don't work with datasets that are protected solely by IP-based access levels. Because background tasks don't run from an end-user IP address, VPC Service Controls blocks the request.

To use automated reporting features behind VPC Service Controls perimeters, configure your data source connection to use service account credentials or create an access level that allows background requests.

Set up a Google Cloud service account

Service accounts prevent reports from breaking if an employee leaves the company, and they allow secure network access inside VPC-SC perimeters. Instead of delegating access by using Owner's credentials, or requiring individual report viewers to have access to the data by using Viewer's credentials, administrators can configure a dedicated Google Cloud service account to query data.

To review required role assignments (roles/bigquery.dataViewer, roles/bigquery.jobUser) and setup steps in the Google Cloud console, see Set up a Google Cloud service account for Data Studio.