Skip to content
Command-line tool for visualizing dependencies and managing permissions between BigQuery views.
Python
Branch: master
Clone or download
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
docs Update README Jun 20, 2019
src/bigquery_view_analyzer Assume view is authorized if referencing table from the same dataset. F… Aug 14, 2019
tests Update table patterns and tests Aug 14, 2019
.gitignore Initial commit Jun 17, 2019
.travis.yml Update travis config Jun 20, 2019
LICENSE Initial commit Jun 17, 2019
README.md Typo. My job is done here. Jun 20, 2019
setup.cfg Initial commit Jun 17, 2019
setup.py Bump version to v19.8.0 Aug 14, 2019

README.md

BigQuery View Analyzer

PyPI version Python versions Build status Github license

Description

bigquery-view-analyzer is a command-line tool for visualizing dependencies and managing permissions between BigQuery views.

To authorize a view, permissions must be granted at a dataset level for every view/table referenced in the view definition. This requirement cascades down to every view that's referenced by the parent view, they too must have permissions granted for every view/table they reference - and so on. This can quickly become difficult to manage if you have many nested views across multiple datasets and/or projects.

bigquery-view-analyzer automatically resolves these dependencies and applies the relevant permissions to all views and datasets referenced by the parent view.

Installation

$ pip install bigquery-view-analyzer

Usage

$ bqva --help

asciicast

Example

Example tree

Given the above datasets and tables in BigQuery, to authorize bqva-demo:dataset_4.shared_view, the following views would need to be authorized with each of the following datasets:

  • Authorized views for dataset_1
    • bqva-demo:dataset_3.view_a_b_c_d
  • Authorized views for dataset_2
    • bqva-demo:dataset_3.view_a_b_c_d
    • bqva-demo:dataset_1.view_c
  • Authorized views for dataset_3
    • bqva-demo:dataset_2.view_d
    • bqva-demo:dataset_4.shared_view

You can easily visualize the above view hierarchy using the bqva tree command.

# View dependency tree and authorization status for 'bqva-demo:dataset_4.shared_view'
$ bqva tree --status --no-key --view "bqva-demo:dataset_4.shared_view"
bqva-demo:dataset_4.shared_view
└── bqva-demo:dataset_3.view_a_b_c_d (⨯)
    ├── bqva-demo:dataset_1.table_a (⨯)
    ├── bqva-demo:dataset_1.table_b (⨯)
    ├── bqva-demo:dataset_1.view_c (⨯)
    │   └── bqva-demo:dataset_2.table_c (⨯)
    └── bqva-demo:dataset_2.view_d (⨯)
        └── bqva-demo:dataset_3.table_d (⨯)

Permissions can be applied automatically to all datasets referenced by the parent view using the bqva authorize command.

# Apply all permissions required by 'bqva-demo:dataset_4.shared_view'
$ bqva authorize --view "bqva-demo:dataset_4.shared_view"
bqva-demo:dataset_4.shared_view
└── bqva-demo:dataset_3.view_a_b_c_d (✓)
    ├── bqva-demo:dataset_1.table_a (✓)
    ├── bqva-demo:dataset_1.table_b (✓)
    ├── bqva-demo:dataset_1.view_c (✓)
    │   └── bqva-demo:dataset_2.table_c (✓)
    └── bqva-demo:dataset_2.view_d (✓)
        └── bqva-demo:dataset_3.table_d (✓)

If you want to revoke permissions for a view, you can do that too!

# Revoke all permissions granted to 'bqva-demo:dataset_4.shared_view'
$ bqva revoke --view "bqva-demo:dataset_4.shared_view"
bqva-demo:dataset_4.shared_view
└── bqva-demo:dataset_3.view_a_b_c_d (⨯)
    ├── bqva-demo:dataset_1.table_a (⨯)
    ├── bqva-demo:dataset_1.table_b (⨯)
    ├── bqva-demo:dataset_1.view_c (⨯)
    │   └── bqva-demo:dataset_2.table_c (⨯)
    └── bqva-demo:dataset_2.view_d (⨯)
        └── bqva-demo:dataset_3.table_d (⨯)
You can’t perform that action at this time.