BigQuery のリソースへのアクセスを IAM Conditions とリソース名で制御してみた

# テーブルの API を制限する条件を記述したファイルを作成
cat << EOF > condition_table.json
{
  "title": "iam_conditions_dataset_Table",
  "expression":
    "resource.name.startsWith('projects/<PROJECT_ID>/datasets/iam_conditions_dataset') && resource.type == 'bigquery.googleapis.com/Table'"
}
EOF

# データセットの API を制限する条件を記述したファイルを作成
cat << EOF > condition_dataset.json
{
  "title": "iam_conditions_dataset_Dataset",
  "expression":
    "resource.name.startsWith('projects/<PROJECT_ID>/datasets/iam_conditions_dataset') && resource.type == 'bigquery.googleapis.com/Dataset'"
}
EOF

# テーブルの API の条件を付与した BigQuery Data Viewer の権限を付与
gcloud projects add-iam-policy-binding <PROJECT_ID> \
  --member "serviceAccount:access-dataset@<PROJECT_ID>.iam.gserviceaccount.com" \
  --role "roles/bigquery.dataViewer" \
  --condition-from-file condition_table.json

# データセットの API の条件を付与した BigQuery Data Viewer の権限を付与
gcloud projects add-iam-policy-binding <PROJECT_ID> \
  --member "serviceAccount:access-dataset@<PROJECT_ID>.iam.gserviceaccount.com" \
  --role "roles/bigquery.dataViewer" \
  --condition-from-file condition_dataset.json

# BigQuery Job User の権限を付与
gcloud projects add-iam-policy-binding <PROJECT_ID> \
  --member "serviceAccount:access-dataset@<PROJECT_ID>.iam.gserviceaccount.com" \
  --role "roles/bigquery.jobUser" \
  --condition None

# 制限をかけたサービスアカウントの権限を借用
$ gcloud config set auth/impersonate_service_account access-dataset@<PROJECT_ID>.iam.gserviceaccount.com

# データセットの一覧を表示
$ bq ls

> WARNING: This command is using service account impersonation. All API calls will be executed as [access-dataset@<PROJECT_ID>.iam.gserviceaccount.com].
        datasetId         
 ------------------------ 
  iam_conditions_dataset  

# iam_conditions_dataset 配下のテーブル一覧を表示
$ bq ls iam_conditions_dataset

> WARNING: This command is using service account impersonation. All API calls will be executed as [access-dataset@<PROJECT_ID>.iam.gserviceaccount.com].
  tableId   Type    Labels   Time Partitioning   Clustered Fields  
 --------- ------- -------- ------------------- ------------------ 
  sample1   TABLE                                                  
  sample2   TABLE 

# iam_conditions_dataset.sample1 のテーブルにクエリを発行
$ bq query --nouse_legacy_sql 'SELECT COUNT(*) FROM iam_conditions_dataset.sample1'

> WARNING: This command is using service account impersonation. All API calls will be executed as [access-dataset@<PROJECT_ID>.iam.gserviceaccount.com].
 +-----+
 | f0_ |
 +-----+
 |   0 |
 +-----+

# テーブルの API を制限する条件を記述したファイルを作成
cat << EOF > condition.json
{
  "title": "iam_conditions_table",
  "expression":
    "resource.name == 'projects/<PROJECT_ID>/datasets/iam_conditions_table/tables/all_user_can_not_access' && resource.type == 'bigquery.googleapis.com/Table'"
}
EOF

# テーブルの API の条件を付与した BigQuery Data Viewer の権限を付与
gcloud projects add-iam-policy-binding <PROJECT_ID> \
  --member "serviceAccount:access-table@<PROJECT_ID>.iam.gserviceaccount.com" \
  --role "roles/bigquery.dataViewer" \
  --condition-from-file condition.json

# BigQuery Job User の権限を付与
gcloud projects add-iam-policy-binding <PROJECT_ID> \
  --member "serviceAccount:access-table@<PROJECT_ID>.iam.gserviceaccount.com" \
  --role "roles/bigquery.jobUser" \
  --condition None

# 制限をかけたサービスアカウントの権限を借用
$ gcloud config set auth/impersonate_service_account access-table@<PROJECT_ID>.iam.gserviceaccount.com

# iam_conditions_table 配下のテーブル一覧を表示
$ bq ls iam_conditions_table

> WARNING: This command is using service account impersonation. All API calls will be executed as [access-table@<PROJECT_ID>.iam.gserviceaccount.com].
BigQuery error in ls operation: Access Denied: Dataset <PROJECT_ID>:iam_conditions_table: Permission bigquery.tables.list denied on dataset <PROJECT_ID>:iam_conditions_table (or it may not exist).

# iam_conditions_table.all_user_can_not_access のテーブルにクエリを発行
$ bq query --nouse_legacy_sql 'SELECT COUNT(*) FROM iam_conditions_table.all_user_can_not_access'

> WARNING: This command is using service account impersonation. All API calls will be executed as [access-table@<PROJECT_ID>.iam.gserviceaccount.com].
 +-----+
 | f0_ |
 +-----+
 |   0 |
 +-----+