ReleaseBytes
gcp Google Cloud Blog ·

BigQuery introduces IAM data governance tags for column-level security

blogdatagcppreviewengineergcp-bigquery
feature announcement

BigQuery has released a preview of IAM data governance tags, a new method for column-level access control that improves upon existing policy tags. These tags offer global scope, automatic disaster recovery replication, hierarchical classification up to five levels deep, and decoupled governance for more flexibility. This feature is available to all BigQuery customers and is particularly beneficial for those managing complex data ecosystems and seeking to enhance their data protection strategies.

  • →Introduce data governance tags in BigQuery
  • →Apply data governance tags using JSON schema or SQL
  • →Global scope and regional enforcement for data governance tags
  • →Managed disaster recovery for security policies
  • →Hierarchical security classification for data
Features (2) ›
  • Introduce data governance tags in BigQuery

    BigQuery now offers a preview of IAM data governance tags, a new approach to column-level security that builds on Google Cloud's Resource Manager infrastructure. This feature allows for more scalable and robust management of access controls and data protection within BigQuery.

  • Apply data governance tags using JSON schema or SQL

    Users can attach data governance tags to BigQuery columns by updating table schemas via JSON files and the bq CLI, or directly using SQL statements for creation and modification.

Enhancements (4) ›
  • Global scope and regional enforcement for data governance tags

    Unlike regional-only policy tags, data governance tags are global, enabling a single tag key:value pair defined at the organization level to be used across all projects and regions.

  • Managed disaster recovery for security policies

    Data governance tags and their associated data policies are automatically replicated to secondary regions, ensuring security posture persists during failovers and disaster recovery scenarios.

  • Hierarchical security classification for data

    Data governance tags support a hierarchical tree structure up to five levels deep, enabling more granular data classification and inheritance for precise access control.

  • Decoupled governance for flexible data onboarding

    Data can be tagged and classified before security policies are enforced, providing increased flexibility during the data onboarding process.

Read the original announcement →

https://cloud.google.com/blog/products/data-analytics/level-up-your-column-level-security-using-iam-data-governance-tags-in-bigquery/

Related releases