Integrating BigQuery

Capabilities

Cyera's BigQuery integration provides the following capabilities:

Product	Capability
Cyera Privacy	Request Types Access, Deletion, Do Not Sell/Share, Identifiers Identifier Categories Any
Live Data Map	Data Discovery

Before You Start

To successfully configure this integration, please ensure you have sufficient privileges:

• BigQuery User Role: Admin
• Secrets Manager: Write Access
• IAM Roles: Write Access

Connecting with RM Agent

The Cyera Privacy Agent allows you to automate Data Subject Requests by connecting to internal systems within your network, and without requiring ingress from the public network.

The Agent connects to your BigQuery using least privileged IAM roles that you will configure. Additional connection details will be stored securely in a secrets manager. When configuring the BigQuery integration in Cyera, only the location of that secrets manager entry will be referenced (e.g., Google Cloud Secret Manager resource name), which ensures that no secrets are shared directly with Cyera.

Prerequisites

Before you can connect to BigQuery, ensure the following:

• RM Agent is deployed and connected in Cyera.
• Network is configured to allow the Agent to connect with the BigQuery instance.

Store Connection Details

1. To specify the target project, configure the following JSON key-value pairs:

   {
     "project_id": "<project ID>"
   }

2. Store the JSON value in your secrets manager with a name like cyera.rm-agent.bigquery.

3. Ensure that the Agent has the necessary permissions to access this vault entry.

Add the Agent Integration

1. In Cyera, navigate to Agents and select your Agent.
2. In the top right, select Add New Integration and search for BigQuery.
3. Under Enabled Capabilities and Enabled Identifiers, select only those that will be used for this integration.
4. Enter the Connection Details Location (e.g. Google Cloud Secret Manager resource name).
5. Select the Data Retrieval behavior for deletion requests.
   warning

   When using Retrieve Data, the data reviewed may not be exactly what is deleted due to the access and deletion logic executing separately!

6. Under Agent Query Configuration, add request logic to be executed within BigQuery for all enabled request types.
   Query Parameter Format

   Use scalar paramstyle when formatting query parameters with identifiers (e.g., email, user_id).

   Example:

   SELECT * FROM users WHERE email = @email

7. Finally, select Configure Integration. Wait a few moments to ensure that the connection is successful. For failed connections, review the Agent container logs for additional details.