## Choose how Atlan connects to Google BigQuery

URL: https://docs.atlan.com/apps/connectors/data-warehouses/google-bigquery/how-tos/choose-how-atlan-connects-to-google-bigquery

> Pick the network path and authentication method Atlan uses to reach Google BigQuery - public API endpoint or Private Service Connect, service account key or Workload Identity Federation.

BigQuery is different from most databases: there is no server address to open a hole for. Atlan talks to Google's BigQuery *API* over HTTPS. Your choices are about **which network path** those API calls take and **how Atlan proves who it is**. This page helps you pick both in a few minutes.

## Before you start: Two facts you need

Gather these first - they determine which options apply to you and prevent the two most common multi-day support loops.

| Fact | How to find it |
|---|---|
| **Does your Google Cloud organization use VPC Service Controls?** (a Google feature that puts an invisible security fence - a "perimeter" - around your projects) | Ask your Google Cloud administrator or security team: *"Are our BigQuery projects inside a VPC Service Controls perimeter?"* If yes, read [VPC Service Controls & allowlisting](https://docs.atlan.com/llms/connectors/google-bigquery/vpc-service-controls-and-allowlisting/llms.txt) before creating any connection - an unprepared perimeter blocks Atlan with a `403 … prohibited by organization's policy` error. |
| **Does your security policy allow service account key files?** (a downloadable JSON credential that never expires) | Ask your security team. Many organizations ban long-lived keys - in that case use **Workload Identity Federation** (keyless, short-lived tokens). Note one current limitation: the Data Quality studio still requires a key file (see [Special cases](https://docs.atlan.com/llms/connectors/google-bigquery/special-cases/llms.txt)). |

## Compare two decisions

### Decision 1 - the network path

| | Public API endpoint | Private Service Connect (PSC) | Self-deployed runtime |
|---|---|---|---|
| **Traffic path** | Atlan → `bigquery.googleapis.com` over the public internet, always TLS-encrypted | Atlan → a private Google endpoint inside Atlan's network; traffic stays on Google's internal backbone | A runtime you host calls the BigQuery API from inside your own network, then pushes results to Atlan over outbound HTTPS |
| **Who is involved** | You + your Google Cloud admin | You + Atlan support (Atlan builds the endpoint) | Your infrastructure team |
| **Typical setup time** | Minutes | A few business days (one support ticket; **no approval step on your side**) | Days to weeks |
| **Anything to allowlist?** | Only if you use VPC Service Controls - see [VPC Service Controls & allowlisting](https://docs.atlan.com/llms/connectors/google-bigquery/vpc-service-controls-and-allowlisting/llms.txt) | Same - PSC does *not* replace VPC-SC rules | Outbound HTTPS (port 443) to `*.atlan.com` |
| **Start here** | [Set up authentication](https://docs.atlan.com/llms/connectors/google-bigquery/set-up-authentication-for-google-bigquery/llms.txt) | [PSC guide](https://docs.atlan.com/llms/connectors/google-bigquery/set-up-google-private-service-connect/llms.txt) | [Self-deployed runtime docs](https://docs.atlan.com/llms/platform/self-deployed-runtime/llms.txt) |

### Decision 2 - the authentication method

| | Service account JSON key | Workload Identity Federation (WIF) |
|---|---|---|
| **What it is** | A downloadable credential file you paste into Atlan | Keyless: Atlan exchanges a short-lived identity token with Google each time it connects |
| **Security posture** | Long-lived secret; must be rotated and can be revoked out from under you | No stored secret; recommended for organizations that ban key files |
| **Setup effort** | ~15 minutes | ~1 hour (identity pool + provider + attribute mapping in Google Cloud) |
| **Known limitation** | Scheduled runs break silently when someone rotates or deletes the key | Data Quality studio doesn't support WIF yet; VPC-SC perimeters need WIF-specific rules |
| **Guide** | [Set up authentication, Path A](https://docs.atlan.com/llms/connectors/google-bigquery/set-up-authentication-for-google-bigquery/llms.txt) | [Set up authentication, Path B](https://docs.atlan.com/llms/connectors/google-bigquery/set-up-authentication-for-google-bigquery/llms.txt) |

:::info The two decisions are independent

Any auth method works over any network path: key file over public, WIF over PSC, and so on. Pick the strictest combination your team can operate - most customers run **public endpoint + service account key**; security-conscious ones run **PSC + WIF**.

:::

## Which method to pick

- **Public endpoint + service account key** - the fastest path. All traffic is TLS-encrypted; "public" means the route, not the visibility of your data.
- **Add Private Service Connect** if your policy prohibits data-platform API calls over the public internet. One support ticket; Atlan does the build; no approval handshake needed on your side (BigQuery is a Google-managed service with automatic PSC approval).
- **Use WIF** if key files are banned. Budget the extra Google Cloud setup and read the VPC-SC note if you have perimeters.
- **Self-deployed runtime** only if policy requires that no Atlan-hosted component holds your credentials - with SDR, credentials stay inside your perimeter.

:::caution Using VPC Service Controls? Read that page first - whatever you pick

VPC-SC perimeters are the single largest cause of hard-to-diagnose BigQuery connection failures. PSC does not bypass them, and WIF needs *different* perimeter rules than key-file auth. Ten minutes on [VPC Service Controls & allowlisting](https://docs.atlan.com/llms/connectors/google-bigquery/vpc-service-controls-and-allowlisting/llms.txt) saves days of back-and-forth.

:::

## See also

- [How BigQuery connectivity works](https://docs.atlan.com/llms/connectors/google-bigquery/how-bigquery-connectivity-works/llms.txt): The 5-minute explainer - no Google Cloud knowledge assumed. Read this if "service account", "perimeter", or "PSC" are new to you.
- [Atlan Network Details](https://docs.atlan.com/llms/governance/administration/atlan-network-details/llms.txt): The identities Atlan presents and what's tenant-specific via support.
- [Set up authentication for Google BigQuery](https://docs.atlan.com/llms/connectors/google-bigquery/set-up-authentication-for-google-bigquery/llms.txt): Both auth paths in phases, each labeled with who performs it.
- [VPC Service Controls & allowlisting](https://docs.atlan.com/llms/connectors/google-bigquery/vpc-service-controls-and-allowlisting/llms.txt): The exact Google services and rules your security team must allow.

---