Google BigQuery

Iru connects to BigQuery to pull column-level access to sensitive fields, and a record of exactly who queried what. It reads IAM policy matrices, dataset access controls, and query audit logs directly.

Key Capabilities

• Confirm all data is encrypted at rest under Google-managed or customer-managed keys
• Verify dataset access follows least privilege with no allAuthenticatedUsers exposure
• Check that column-level security protects PII fields
• Track query activity as it's logged and retained for 90 days or more
• Confirm service accounts avoid broad project Editor roles

Evidence Collected

• IAM policy matrix across project, dataset, and table
• Dataset access control lists and policy tag assignments
• Query and job audit logs showing who accessed or exported which dataset
• Encryption configuration and customer managed key usage
• Table expiration and retention settings

Learn more