In this chapter, we are going to learn how to connect the Google Cloud Platform (GCP) to our Looker account.
If you use Looker (Google Cloud core), Application Default Credentials (ADC) can connect to BigQuery without downloading a service account key. See Google’s Cloud core connection documentation for that approach.
Before you start, you need a Looker instance with permission to manage connections, a Google Cloud project with billing and the BigQuery API enabled, and an existing dataset. You also need permission to create a service account and its key, and to grant the roles below. For this introductory example, use one project for the service account, query billing and data. Persistent derived tables (PDTs) are left disabled.
Let’s start!
1 Open Google Cloud credentials
Go to the Google Cloud Platform home page. From APIs & Services, select Credentials. Make sure the correct project is selected.
(opens in a new tab)2 Create a service account
From CREATE CREDENTIALS, select Service account.
(opens in a new tab)3 Fill in the service account details
Select a name for the Service account.
Check the generated Service account ID.
Add description (optional).
Press CREATE AND CONTINUE.
(opens in a new tab)4 Grant permission to run queries
In Permissions (optional), select BigQuery Job User (roles/bigquery.jobUser). Select Continue. This lets the service account run query jobs in the project that will be billed.
(opens in a new tab)5 Finish creating the service account
Leave Principals with access (optional) empty. You will be able to add users later on if needed.
Select DONE.
6 Grant access to the dataset
In BigQuery, open the dataset you want to use, then choose Share > Manage permissions > Add principal. Grant the service account BigQuery Data Viewer (roles/bigquery.dataViewer) on that dataset. Use the service account’s email address as the principal, then select Save.
(opens in a new tab)For this read-only example, BigQuery Admin is not required. If you later enable PDTs, configure a separate scratch dataset with suitable write permissions, such as BigQuery Data Editor, as well as permission to run jobs.
7 Open the service account
Go to IAM & Admin > Service Accounts, and click on the account you’ve just created.
(opens in a new tab)8 Create a JSON key
In the keys tab, from Add Key, select Create new key.
(opens in a new tab)Select JSON, then select Create. A JSON file that contains the key will be downloaded to your PC.
(opens in a new tab)If your organization blocks service account key creation, ask your administrator to confirm the approved authentication method before continuing.
Keep the JSON key private. Do not publish it, commit it to a repository or share it. Upload it only to the intended Looker connection and handle the local copy according to your organization’s credential policy.
9 Open Looker connections
Choose Admin > Database > Connections > Add Connection.
(opens in a new tab)10 Set the connection name and dialect
Choose a Name.
In General Settings, in the SQL Dialect setting, choose Google BigQuery Standard SQL. Select Next to open Database Settings.
(opens in a new tab)11 Enter the project and dataset
(opens in a new tab)In Billing Project ID, enter the Google Cloud project ID that will be billed for the queries. Use the project ID, not its display name. In this example, this is also the project that contains your dataset.
In Primary Dataset (shown as Dataset in some interfaces), enter the dataset ID. Use the dataset ID only, without a project prefix.
(opens in a new tab)12 Upload the service account key
In Database Settings, under Authentication Settings, select Service Account as the Authentication Method.
In Service Account Certificate, upload the JSON file you’ve downloaded earlier. This control accepts JSON or P12 files; older interfaces label it Upload service JSON or P12 File.
(opens in a new tab)The Service Account Email field applies to P12 files; it is not required for this JSON example. Select Next to open Optional Settings, and leave Enable PDTs off.
(opens in a new tab)13 Test and save the connection
Let’s test it. Select Test Connection in the connection settings and review the results. Go to Review, check the settings, and select Save to save the connection. Older interfaces may label these controls Test and Connect or Add Connection.
Find your connection on the list and press the Test button. Confirm that the connection and query checks pass. If a check fails, read its error before continuing; verify the project ID, dataset ID, credentials and IAM grants.
You are all set!