BigQuery tables should not be publicly readable
Checks that BigQuery datasets are not anonymously or publicly accessible. Datasets that grant any role to `allUsers` or `allAuthenticatedUsers` are flagged as publicly accessible.
Public dataset access erodes confidentiality by enabling unrestricted reads and metadata discovery. Attackers can query and copy data for exfiltration and use schema details for lateral movement. It can also trigger unexpected costs from abusive or high-volume queries.
What this control checks
BigQuery datasets must not grant access to allUsers or allAuthenticatedUsers.
Common pitfalls
Manually adding allUsers to the dataset fails the check
The check also fails an access block with only the role key found in the statefile, when manually adding allUsers to the dataset.
Audit evidence
Evidence that deployed resources meet this control: Prowler check bigquery_dataset_public_access (prowler gcp --checks bigquery_dataset_public_access); PowerPipe control gcp_compliance.control.require_bq_table_iam.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_15.
Framework-specific interpretation
SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...), CC6.3 (The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets...) and CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
PCI DSS v4.0: Mapped to 2.2.7 (System components are configured and managed securely.), 3.5.1 (Primary account number (PAN) is secured wherever it is stored.), 3.5.1.3 (Primary account number (PAN) is secured wherever it is stored.) and 3 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 11.2.2.e (maintain a register of access rights granted;).
NIST SP 800-53 Rev 5: Mapped to AC-3 (Account Management), AC-5 (Separation Of Duties), AC-6 (Least Privilege) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 2.2.7: System components are configured and managed securely.
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
1 more clause
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- 11 Access control
- AC-5 Separation Of Duties
- AC-6: Least Privilege
- Access Enforcement (AC-3)
- Media Access (MP-2)
- 7.1 Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible
- 7.1 Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service...
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
2 more clauses
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 7.1 It is recommended that the IAM policy on BigQuery datasets does not allow anonymous and/or public access.
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii) Implementation specifications
- 164.308(a)(4)(i) Information access management
- 164.312(a)(1) Access control
NIST Cybersecurity Framework v1.0
- PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- Limit access to system components and cardholder data to only those individuals whose job requires such access
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
require_bq_table_iam - Checkov Check:
CKV_GCP_15 - Powerpipe Control:
gcp_compliance.control.require_bq_table_iam - Prowler Check:
bigquery_dataset_public_access
Last reviewed: 2026-10-09