Using Service Accounts

You can use service accounts in your Community Connectors for centralized management of resource access. A common use case would be to delegate access to data that users would not able to access using their own credentials.

Review Understanding service accounts to familiarize yourself with the topic.

Benefits

  • You can consolidate billing for data access.
  • You can implement your own access control layer in your connector.
  • You can delegate access to data or resources that the user's credentials does not have access to.

Implementation steps

  1. Create a service account for the platform from which you are fetching data.
  2. Provide the necessary permissions to the service account so it can access required resources.
  3. Store the service account's credentials in your connector's script properties.
  4. During connector execution, use the stored credentials to fetch required data.
  5. Optional: Implement access control logic to filter the data.

Example: Accessing BigQuery with Data Studio Advanced Services and a service account

You are building a solution where your users will build dashboards from a BigQuery table. If your users use Data Studio's BigQuery connector, they will need read access to the BigQuery table. They will also require a billing account for Google Cloud Platform (GCP). The following steps illustrate how to use a service account to consolidate billing and delegate access to the BigQuery data.

  1. Create a service account in your desired GCP project.
  2. Ensure the service account can create BigQuery jobs and view the data for the required table. See BigQuery Access Control for details.
  3. Create a key for the service account and store the credentials in your connector's script properties.
  4. Include the OAuth2 Apps Script library in your Apps Script project.
  5. For your getData function, authenticate the service account and generate an access token. Set the OAuth2 scope to https://www.googleapis.com/auth/bigquery.readonly.
  6. Return access token with other configuration items in getData response.