BigQuery Authentication

There are two ways to authenticate the BigQuery plugin - either by uploading a Service Account key file, or by automatically retrieving credentials from the Google metadata server. The latter option is only available when running Grafana on a GCE virtual machine.

Uploading a Service Account Key File

First you need to create a Google Cloud Platform (GCP) Service Account for the Project you want to show data for. A Grafana datasource integrates with one GCP Project. If you want to visualize data from multiple GCP Projects then you need to create one datasource per GCP Project.

The BigQuery Data Viewer role and the Job User role provides all the permissions that Grafana needs. The following API needs to be enabled on GCP for the datasource to work: BigQuery API

GCE Default Service Account

If Grafana is running on a Google Compute Engine (GCE) virtual machine, it is possible for Grafana to automatically retrieve the default project id and authentication token from the metadata server. In order for this to work, you need to make sure that you have a service account that is setup as the default account for the virtual machine and that the service account has been given read access to the BigQuery API.

Detailed instructions on how to create a Service Account can be found in the documentation.