search

hasura / graphql-engine

Blazing fast, instant realtime GraphQL APIs on your DB with fine grained access control, also trigger webhooks on database events.
https://hasura.io
Apache License 2.0
31.06k stars 2.77k forks source link

docs/bigquery: connecting to a bigquery project #6900

Open 0x777 opened 3 years ago

0x777 commented 3 years ago

The following are required by graphql-engine to connect to a BigQuery project.

  1. Project Id
  2. The datasets that can be exposed over graphql - these have to be explicitly listed.
  3. A Service Account to query the project.

Creating a service account

  1. In google cloud's console, head to your bigquery project.

  2. IAM and Admin > Service Accounts > Create Service Account

  3. Give it a name, and under roles, and grant these 3 roles: 'Bigquery Metadata Viewer', 'BigQuery Data Viewer' and 'BigQuery Job User'.

  4. Click on the created service account, Keys > ADD KEY > Create New Key > JSON > Create. This will download a service account file on your computer.

Connecting to a BigQuery project

  1. Run graphql-engine with an environment variable set to the contents of the service account. This maybe done as follows if you are using docker: 
    docker run -e BIGQUERY_SA_ACCOUNT=$(cat /path/to/the/service-account.json) <rest-of-the-flags>

  2. Head to the console, in the 'Connect Existing Database' page, choose 'Environment Variable' under 'Connect Via', and fill in the necessary details:

coco98 commented 3 years ago

This should work v2.0-alpha.10 onwards. Here's a link to the docker-compose.yaml to get started with.

We'll be putting all of this information on our docs soon!

cyclonstep commented 3 years ago

Hi, can I use the bigquery connection using default service account that came from the compute engine vm? Because I don't want to issue credentials files.

bencrispin commented 3 years ago

Will support for mutations be added?

lmakarov commented 2 years ago

Absolutely need a way to use the (default) service account that Hasura was launched with instead of passing the contents of service-account.json as an environment variable.

This could be done by either allowing the Environment Variable / Service Account Key inputs to stay empty or as a separate connection option.