Security update for Looker (Google Cloud core) service agent permissions

This document provides details about a security update regarding the default IAM permissions assigned to the Looker (Google Cloud core) service agent.

To adhere to the principle of least privilege and enhance the security of your data, Google is deprecating the legacy Looker Service Agent role (roles/looker.serviceAgent) and replacing it with a new, scoped-down role (roles/looker.restrictedServiceAgent).

The legacy role grants broad BigQuery permissions by default, which can allow Looker administrators to execute data modification queries using the Looker SQL Runner. To mitigate this risk, Google has proactively attached the new restricted role to your existing Looker service accounts. However, you must take manual action to re-grant necessary BigQuery permissions before the legacy role is permanently retired.

What you need to do

To ensure that your Looker workflows and persistent derived tables (PDTs) continue to function without interruption, complete the following steps before the legacy role is deprecated on January 11, 2027:

1. Grant explicit BigQuery permissions

If your Looker instance relies on BigQuery, you must explicitly grant the required BigQuery roles to your Looker service agent:

[e-mail]

Replace PROJECT_NUMBER with your Google Cloud project number.

At a minimum, grant the following roles:

• BigQuery Job User (roles/bigquery.jobUser): Grant this role on your designated billing project to allow query execution.
• BigQuery Data Viewer (roles/bigquery.dataViewer): Grant this role on the specific projects where your data resides.

Alternatively, you can configure the Looker service agent to impersonate a dedicated service account that holds these specific permissions.

2. Remove the legacy role

After granting the explicit BigQuery permissions, manually remove the legacy roles/looker.serviceAgent role binding from your Looker service agent in the Google Cloud console:

1. In the Google Cloud console, go to the IAM page.
2. Locate your Looker service agent ([e-mail]).
3. Remove the legacy roles/looker.serviceAgent role binding.

Note: In the Google Cloud console IAM page, both the legacy and restricted roles might be displayed as Looker Service Agent. Review the role description or the underlying role ID to ensure that you are removing the legacy role (roles/looker.serviceAgent) and keeping the restricted role (roles/looker.restrictedServiceAgent).

Impact of inaction

If you don't grant explicit BigQuery roles and the legacy role is automatically deprecated on January 11, 2027, your Looker instance might lose the ability to run BigQuery jobs, which will result in interrupted queries, failing dashboards, and broken PDT builds.

Need help?

For detailed instructions about configuring BigQuery permissions for Looker, see the Google BigQuery documentation.

If you have questions or require assistance during this migration, contact Google Cloud Support.