services / Google Cloud / BigQuery jobs

Jobs run queries and other asynchronous actions (load, export, copy) against BigQuery resources. `create` is the single gating permission for every job type.

Holding `create` alone only lets a caller submit a job and pay for it, not read, modify, or destroy any data. Data exfiltration or modification additionally requires `bigquery.tables.getData`/`update`/`delete` (services/gcp/bigquery/tables.yml), whether granted directly on the table or inherited from a dataset- or project-level binding.

bigquery.​jobs.​listAll

Lists every job in the project/folder/org, including other users' un-redacted job metadata.

Risks

1. Account discovery (LOW)
2. Infrastructure discovery (LOW)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links