Before you create a Google BigQuery workspace

Creating the service accounts for the source and destination databases

Tonic Structural uses service accounts to access both the source and destination datasets.

Even if the source and destination are in the same BigQuery project, Structural recommends that you create separate service accounts for the source and destination.

When you create the service account for the source dataset, you should use the "Viewer" role to grant the service account access to the project. Structural does not require write permissions to the source dataset.

When you create the service account for the destination dataset, you should use the "Editor" role to grant the service account access to the project.

Setting up Application Default Credentials (self-hosted only)

Structural Cloud users must use service accounts for database connections.

Self-hosted instances can also use Application Default Credentials (ADC).

The credentials are loaded using ADC chain. For example, the credentials might be loaded from the GOOGLE_APPLICATION_CREDENTIALS environment variable, or from attached service accounts on the Tonic Structural containers.