Choose how Atlan connects to Google BigQuery
Pick the network path and authentication method Atlan uses to reach Google BigQuery - public API endpoint or Private Service Connect, service account key or Workload Identity Federation.
BigQuery is different from most databases: there is no server address to open a hole for. Atlan talks to Google's BigQuery API over HTTPS. Your choices are about which network path those API calls take and how Atlan proves who it is. This page helps you pick both in a few minutes.
Before you start: Two facts you need
Gather these first - they determine which options apply to you and prevent the two most common multi-day support loops.
| Fact | How to find it |
|---|---|
| Does your Google Cloud organization use VPC Service Controls? (a Google feature that puts an invisible security fence - a "perimeter" - around your projects) | Ask your Google Cloud administrator or security team: "Are our BigQuery projects inside a VPC Service Controls perimeter?" If yes, read VPC Service Controls & allowlisting before creating any connection - an unprepared perimeter blocks Atlan with a 403 … prohibited by organization's policy error. |
| Does your security policy allow service account key files? (a downloadable JSON credential that never expires) | Ask your security team. Many organizations ban long-lived keys - in that case use Workload Identity Federation (keyless, short-lived tokens). Note one current limitation: the Data Quality studio still requires a key file (see Special cases). |
Compare two decisions
Decision 1 - the network path
| Public API endpoint | Private Service Connect (PSC) | Self-deployed runtime | |
|---|---|---|---|
| Traffic path | Atlan → bigquery.googleapis.com over the public internet, always TLS-encrypted | Atlan → a private Google endpoint inside Atlan's network; traffic stays on Google's internal backbone | A runtime you host calls the BigQuery API from inside your own network, then pushes results to Atlan over outbound HTTPS |
| Who is involved | You + your Google Cloud admin | You + Atlan support (Atlan builds the endpoint) | Your infrastructure team |
| Typical setup time | Minutes | A few business days (one support ticket; no approval step on your side) | Days to weeks |
| Anything to allowlist? | Only if you use VPC Service Controls - see VPC Service Controls & allowlisting | Same - PSC does not replace VPC-SC rules | Outbound HTTPS (port 443) to *.atlan.com |
| Start here | Set up authentication | PSC guide | Self-deployed runtime docs |
Decision 2 - the authentication method
| Service account JSON key | Workload Identity Federation (WIF) | |
|---|---|---|
| What it is | A downloadable credential file you paste into Atlan | Keyless: Atlan exchanges a short-lived identity token with Google each time it connects |
| Security posture | Long-lived secret; must be rotated and can be revoked out from under you | No stored secret; recommended for organizations that ban key files |
| Setup effort | ~15 minutes | ~1 hour (identity pool + provider + attribute mapping in Google Cloud) |
| Known limitation | Scheduled runs break silently when someone rotates or deletes the key | Data Quality studio doesn't support WIF yet; VPC-SC perimeters need WIF-specific rules |
| Guide | Set up authentication, Path A | Set up authentication, Path B |
Any auth method works over any network path: key file over public, WIF over PSC, and so on. Pick the strictest combination your team can operate - most customers run public endpoint + service account key; security-conscious ones run PSC + WIF.
Which method to pick
- Public endpoint + service account key - the fastest path. All traffic is TLS-encrypted; "public" means the route, not the visibility of your data.
- Add Private Service Connect if your policy prohibits data-platform API calls over the public internet. One support ticket; Atlan does the build; no approval handshake needed on your side (BigQuery is a Google-managed service with automatic PSC approval).
- Use WIF if key files are banned. Budget the extra Google Cloud setup and read the VPC-SC note if you have perimeters.
- Self-deployed runtime only if policy requires that no Atlan-hosted component holds your credentials - with SDR, credentials stay inside your perimeter.
VPC-SC perimeters are the single largest cause of hard-to-diagnose BigQuery connection failures. PSC does not bypass them, and WIF needs different perimeter rules than key-file auth. Ten minutes on VPC Service Controls & allowlisting saves days of back-and-forth.
See also
- How BigQuery connectivity works: The 5-minute explainer - no Google Cloud knowledge assumed. Read this if "service account", "perimeter", or "PSC" are new to you.
- Atlan Network Details: The identities Atlan presents and what's tenant-specific via support.
- Set up authentication for Google BigQuery: Both auth paths in phases, each labeled with who performs it.
- VPC Service Controls & allowlisting: The exact Google services and rules your security team must allow.