Back to Checks
gcp

BigQuery dataset is not publicly accessible

bigquery_dataset_public_access
Service: bigquerySeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedidentity-access
Resource Type:bigquery.googleapis.com/Dataset

BigQuery datasets are evaluated for exposure to public identities. The finding highlights datasets that grant any role to allUsers or allAuthenticatedUsers, which makes the dataset publicly accessible beyond intended principals.

Prowler logoProwlerprowler-provider-gcp

Risk

Public dataset access erodes confidentiality by enabling unrestricted reads and metadata discovery. Attackers can query and copy data for exfiltration and use schema details for lateral movement. It can also trigger unexpected costs from abusive or high-volume queries.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks bigquery_dataset_public_access

Recommendation

Apply least privilege on datasets:

  • Remove allUsers and allAuthenticatedUsers
  • Grant access only to required groups or service accounts
  • Use authorized views or controlled listings for sharing
  • Review access regularly and enforce org policies that block public identities for defense in depth

Remediation

Terraform

# Ensure the dataset is not public by removing public principals from IAM (authoritative for this role)
resource "google_bigquery_dataset_iam_binding" "<example_resource_name>" {
  dataset_id = "<example_resource_id>"
  role       = "roles/bigquery.dataViewer"
  members    = [
    "user:<example_user_email>" # CRITICAL: exclude allUsers/allAuthenticatedUsers to remove public access
  ]
}

Other

1Open Google Cloud Console and go to BigQuery
2In Explorer, select the dataset
3Click SHARING > Permissions
4Remove principals named AllUsers and AllAuthenticatedUsers
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.bigquery.bigquery_client import bigquery_client


class bigquery_dataset_public_access(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for dataset in bigquery_client.datasets:
            report = Check_Report_GCP(metadata=self.metadata(), resource=dataset)
            report.status = "PASS"
            report.status_extended = (
                f"Dataset {dataset.name} is not publicly accessible."
            )
            if dataset.public:
                report.status = "FAIL"
                report.status_extended = (
                    f"Dataset {dataset.name} is publicly accessible."
                )
            findings.append(report)

        return findings

References