Connect BigQuery to Rig

Before you start

• The GCP project ID of the project that owns your data.
• Permission in Google Cloud to create a service account, grant it roles and create a key.
• The dataset Rig should use, and optionally the location it lives in.
• A workspace owner, or a role with the Manage connections permission, in Rig.

Step 1: Create a service account and grant it roles

1. In the Google Cloud console, create a service account in the project, or pick an existing one.
2. Grant it BigQuery Data Viewer (roles/bigquery.dataViewer). On a dataset this lets it list tables and views and read table data, so you can grant it per dataset if you prefer.
3. Grant it BigQuery Job User (roles/bigquery.jobUser) on the project. This role can only be granted on a project, folder or organisation, and it lets the account run queries.

Step 2: Create a JSON key

1. In the Google Cloud console, go to the Service accounts page and select your project.
2. Click the email address of the service account.
3. Open the Keys tab, click the Add key drop-down menu and select Create new key.
4. Select JSON as the Key type and click Create. The key file downloads once and cannot be downloaded again.

Step 3: Create a second account if Rig should ingest

Skip this step if Rig only needs to read.

1. Create another service account and grant it BigQuery Data Editor (roles/bigquery.dataEditor) on the dataset Rig writes to, plus Job User on the project.
2. Create a JSON key for it. Rig refuses a write key that matches the read one.

Step 4: Connect it in Rig

Adding a source needs a workspace owner, or a role with the Manage connections permission, on a workspace where you manage your own connections. If the Connectors tab says “Data ingestion for this workspace is managed by Rig”, ask an owner or Rig support to add the source.

1. In Rig, open Connections. On a workspace with no warehouse yet, the page shows a Set up your warehouse card. Choose Bring your own warehouse.
2. If the workspace already has a warehouse, open the Warehouse stage, click Change warehouse, choose Bring your own and pick the type. Your connected sources and schedules are kept, and data already synced is not copied across, so re-sync afterwards.
3. Choose BigQuery as the Warehouse type.
4. GCP project ID: the project that owns the dataset, for example my-gcp-project.
5. Dataset: the BigQuery dataset Rig uses. When ingestion is on, Rig creates its per-source schemas there.
6. Location (optional): EU, US or a region such as europe-west2. Leave it blank to let Rig detect it from your existing datasets. Set it if the project has no datasets yet.
7. Service account JSON: open the key file you downloaded and paste its full contents.
8. The credential fields appear once for the read credential, labelled with a (read) suffix. Rig only reads your warehouse unless you add a write credential.
9. To let Rig also sync your connected tools into this warehouse, switch on Let Rig ingest data into this warehouse and fill the same credential fields again, now labelled (write / ingestion). The write credential must differ from the read one, and Rig blocks the form if they match.
10. Click Provision workspace. Rig stores the credentials in AWS Secrets Manager and does not echo them back.
11. To rotate a credential later, open the Warehouse stage and click Update credentials. Fill in only what you want to change and leave the rest blank.

What Rig reads

• Datasets, tables and views: Rig reads the structure of your project's datasets and builds its context layer from it.
• dbt models: Tables that dbt builds are read like any other table, with dbt lineage kept alongside them.
• Query results: Questions run as BigQuery SQL in your project, and results go to the person asking.
• Ingested sources: Only if you add a write key, Rig also creates a dataset schema per synced tool.

With only a read key Rig cannot create or change tables.

Good to know

• Query jobs bill to the project you enter, and BigQuery charges by the data a query scans.
• Leaving Location (optional) blank is safe when the project already has datasets. Rig refuses the connection if it cannot work the location out.
• Google service account keys never expire by default, and a service account can hold up to 10 keys. An organisation policy can set an expiry, so check it if a working connection later fails.
• The key is stored in AWS Secrets Manager and is never logged.

What people use this for

• Turn plain-English questions into BigQuery SQL
• Keep BigQuery scan costs predictable
• Analyse GA4 and product events modelled in BigQuery
• Query BigQuery from inside your AI assistant

More ideas for using BigQuery

BigQuery documentation

• BigQuery roles and permissions
• Create and delete service account keys