As of April 20th, 2026, BigLake is now called Lakehouse for Apache Iceberg. BigLake metastore is now called the Lakehouse runtime catalog. Lakehouse APIs, client libraries, CLI commands, and IAM names remain unchanged and still reference BigLake.

Publish Lakehouse tables to SAP BDC

This document explains how to configure Google Cloud to let SAP Business Data Cloud (BDC) access BigQuery data without copying it. You do this by setting up the Apache Iceberg REST catalog endpoint in the Lakehouse for Apache Iceberg runtime catalog or a Knowledge Catalog Data Product to share with SAP.

For an overview of this integration and its use cases, see About SAP BDC integration.

Before you begin

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

Verify that billing is enabled for your Google Cloud project.

Enable the BigLake and Dataplex APIs.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the APIs

Verify that billing is enabled for your Google Cloud project.

Enable the BigLake and Dataplex APIs.

Roles required to enable APIs

Enable the APIs

Cloud Storage bucket: Create a Cloud Storage bucket to store your Iceberg metadata and data files. For instructions, see Create buckets. All resources, including the backend bucket, must exist in the same region to avoid configuration pipeline failures.
Apache Iceberg REST catalog: Set up an Apache Iceberg REST catalog endpoint in the Lakehouse runtime catalog with credential vending enabled, containing the namespaces and tables you want to share. This catalog uses the Cloud Storage bucket as its warehouse. For instructions, see Set up the Iceberg REST catalog.
Delta Sharing connection catalog: Prepare an enrolled Delta Sharing connection catalog for your SAP BDC connection. This is the same catalog created during your initial setup for sharing data from SAP BDC to BigQuery; you do not need to create a new one. For instructions, see Set up cross-cloud Lakehouse for SAP BDC.
Workload Identity Federation (WIF): Prepare to configure WIF to trust the SAP BDC authentication issuer. You will set this up in the following section.

Required roles

To get the permissions that you need to configure Workload Identity Federation and publish data, ask your administrator to grant you the following IAM roles on your project:

Manage Workload Identity Federation: Identity and Access Management (IAM) Workload Identity Pool Admin (roles/iam.workloadIdentityPoolAdmin)
Publish data products: BigLake Admin (roles/biglake.admin)
View catalog metadata (granted to the WIF principal): BigLake Viewer (roles/biglake.viewer)
Consume service quota (granted to the WIF principal): Service Usage Consumer (roles/serviceusage.serviceUsageConsumer)

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

General workflow

To publish data to SAP BDC, follow these steps:

Configure Workload Identity Federation: Create a Workload Identity Federation pool and provider to establish trust with the SAP BDC OIDC issuer.
Grant roles to the federated principal: Grant the federated identity permissions to view catalog metadata and consume service quota.
Publish data: Publish your Apache Iceberg REST catalog or a Knowledge Catalog Data Product to SAP BDC using the gcloud CLI.

Configure Workload Identity Federation

To let SAP BDC access your Lakehouse resources without requiring exported service account keys, configure Workload Identity Federation (WIF). This establishes trust between Google Cloud and the SAP BDC OIDC issuer.

Follow these steps to set up the WIF pool and provider:

Get the Issuer URI

Retrieve the OIDC issuer URI from your Delta Sharing connection catalog. You need this URI to configure the WIF provider.

gcloud alpha biglake delta-sharing catalogs describe CONNECTION_CATALOG_ID \
    --project="PROJECT_ID"

In the command output, locate the federatedIdentityIssuer field, which contains the issuer URI.

Create the Workload Identity Pool

Create a workload identity pool to group external identities.

gcloud iam workload-identity-pools create POOL_ID \
    --location="global" \
    --display-name="POOL_DISPLAY_NAME" \
    --project="PROJECT_ID"

Create the OIDC Provider

Create an OIDC provider within the pool to define trust and map token claims.

gcloud iam workload-identity-pools providers create-oidc PROVIDER_ID \
    --location="global" \
    --workload-identity-pool="POOL_ID" \
    --issuer-uri="ISSUER_URI" \
    --attribute-mapping="google.subject=assertion.sub.split('://')[1].split('.')[0]" \
    --project="PROJECT_ID"

Grant roles to the federated principal

Authorize the federated identity from the trusted pool to call required Google APIs. You can authorize a specific subject UUID or the entire pool.

To authorize a specific subject (recommended):

gcloud projects add-iam-policy-binding PROJECT_ID \
    --role="roles/biglake.viewer" \
    --member="principal://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/subject/WIF_SUBJECT"

gcloud projects add-iam-policy-binding PROJECT_ID \
    --role="roles/serviceusage.serviceUsageConsumer" \
    --member="principal://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/subject/WIF_SUBJECT"

Replace WIF_SUBJECT with the UUID issued by the SAP-side issuer for the workload.

To authorize every identity in the pool (less restrictive, suitable for test environments):

gcloud projects add-iam-policy-binding PROJECT_ID \
    --role="roles/biglake.viewer" \
    --member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/*"

gcloud projects add-iam-policy-binding PROJECT_ID \
    --role="roles/serviceusage.serviceUsageConsumer" \
    --member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/*"

Publish data to SAP BDC

You can publish an Apache Iceberg REST catalog using Google Cloud console or Google Cloud CLI, or you can publish a Knowledge Catalog Data Product containing Iceberg tables using gcloud CLI. Publishing a Data Product isn't supported in Google Cloud console.

Iceberg REST catalog

Before publishing, verify your Iceberg tables have primary keys and at least one row, as SAP BDC requires both for queries.

Console

In the Google Cloud console, go to the Lakehouse Runtime Catalog page.

Go to Lakehouse Runtime Catalog
In the navigation panel, expand your project and select the Delta Catalog (connection catalog) to use for publishing.
Click Publish Data Product.
Enter the required share details, including selecting the Iceberg REST catalog to publish.
Click Publish.

gcloud

Verify the Apache Iceberg REST catalog endpoint exists and get its details:

gcloud alpha biglake iceberg catalogs describe ICEBERG_CATALOG_ID \
    --project="PROJECT_ID"

Publish the Apache Iceberg REST catalog to SAP BDC. Note that the connection catalog, Iceberg catalog, and underlying Cloud Storage bucket must all reside in the same region.
```
gcloud alpha biglake data-product-sharing publish \
    --connection-catalog="projects/PROJECT_ID/catalogs/CONNECTION_CATALOG_ID" \
    --share="SAP_SHARE_NAME" \
    --sap-federated-identity-provider="projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID" \
    --iceberg-catalog="projects/PROJECT_ID/catalogs/ICEBERG_CATALOG_ID" \
    --title="TITLE_TEXT" \
    --short-description="SHORT_DESCRIPTION_TEXT" \
    --description="DETAILED_DESCRIPTION_TEXT" \
    --project="PROJECT_ID"
```
The published Apache Iceberg REST catalog is discoverable in SAP BDC and can be installed in SAP Datasphere as a remote table.

Replace the following:
- CONNECTION_CATALOG_ID: The enrolled Delta Sharing connection catalog that was created during the initial setup for sharing data from SAP BDC to BigQuery. It is the same as the Delta Sharing catalog mentioned in the setup instructions; you do not need to create another one for publishing back.
- PROJECT_NUMBER: Your Google Cloud project number. The sap-federated-identity-provider must use the project number, not the project ID.
- POOL_ID: The WIF pool ID.
- PROVIDER_ID: The WIF provider ID.
- TITLE_TEXT and SHORT_DESCRIPTION_TEXT: Required display values for the share in SAP BDC.
- DETAILED_DESCRIPTION_TEXT: An optional detailed description. Do not enter the same text for the short description and the detailed description, as this will be rejected by SAP. The publish operation is also rejected if the detailed description contains the exact short description as a substring. For example, if the short description is Sales Data, a detailed description of Longer Sales Data details is rejected because it contains Sales Data. However, a detailed description of "Longer Sales Information" is accepted.

Knowledge Catalog Data Product

Alternatively, you can publish a Knowledge Catalog Data Product. A Data Product is a curated, logical grouping of data assets (like tables or views) packaged together to solve specific business problems. Instead of publishing a full catalog, you can select specific Apache Iceberg tables, group them into a Data Product, and publish that curated collection to SAP BDC.

Create the Data Product:

gcloud alpha dataplex data-products create DATA_PRODUCT_ID \
    --location="LOCATION" \
    --display-name="TITLE_TEXT" \
    --description="SHORT_DESCRIPTION_TEXT" \
    --owner-emails="OWNER_EMAIL" \
    --project="PROJECT_ID"

The --display-name maps to the title in SAP BDC, and --description maps to the short_description.

Link a Lakehouse Iceberg Table asset to the Data Product:
```
gcloud alpha dataplex data-products data-assets create DATA_ASSET_ID \
    --data_product="DATA_PRODUCT_ID" \
    --location="LOCATION" \
    --resource="//biglake.googleapis.com/projects/PROJECT_ID/catalogs/ICEBERG_CATALOG_ID/namespaces/NAMESPACE_NAME/tables/TABLE_NAME" \
    --project="PROJECT_ID"
```
When configuring assets in a Data Product, table assets must have primary keys and at least one row. All data assets in a single Data Product must belong to the same Apache Iceberg REST catalog. A Data Product can have a maximum of 50 tables, and must contain at least one valid data asset to publish. Iceberg tables might not appear in the Google Cloud console immediately.

Optional: Verify the assets in your Data Product:

gcloud alpha dataplex data-products data-assets list \
    --data_product="DATA_PRODUCT_ID" \
    --location="LOCATION" \
    --project="PROJECT_ID"

Publish the Data Product to SAP BDC. Ensure that the connection catalog, Data Product, and underlying resources are in the same region.
```
gcloud alpha biglake data-product-sharing publish \
    --connection-catalog="projects/PROJECT_ID/catalogs/CONNECTION_CATALOG_ID" \
    --share="SAP_SHARE_NAME" \
    --sap-federated-identity-provider="projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID" \
    --data-product="projects/PROJECT_ID/locations/LOCATION/dataProducts/DATA_PRODUCT_ID" \
    --project="PROJECT_ID"
```
The published Data Product is discoverable in SAP BDC and can be installed in SAP Datasphere as a remote table. In SAP BDC, the published Data Product inherits the title and short description set when creating the Knowledge Catalog Data Product.

Replace the following:
- CONNECTION_CATALOG_ID: The enrolled Delta Sharing connection catalog that was created during the initial setup for sharing data from SAP BDC to BigQuery. It is the same as the Delta Sharing catalog mentioned in the setup instructions; you do not need to create another one for publishing back.
- PROJECT_NUMBER: Your Google Cloud project number. The sap-federated-identity-provider must use the project number, not the project ID.
- POOL_ID: The WIF pool ID.
- PROVIDER_ID: The WIF provider ID.
- DATA_PRODUCT_ID: The ID of your Knowledge Catalog Data Product.
- LOCATION: The location of your Knowledge Catalog Data Product.
- SAP_SHARE_NAME: The name of the share in SAP BDC.

Accessing Google Cloud data in SAP BDC

After you publish your data to SAP BDC, you can access Google Cloud data natively in the SAP environment. For more information on installing and consuming Data Products in SAP as remote tables, see Installing Data Products in the SAP documentation.

What's next

Troubleshoot cross-cloud Lakehouse for SAP BDC.
Installing Data Products in the SAP documentation.