# 7.1 Ensure BigQuery Datasets Are Not Anonymously or Publicly Accessible (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233051-7-1-ensure-bigquery-datasets-are-not-anonymously-or-publicly-accessible-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability: - Level 1 Description: It is recommended to ensure that the IAM policy for BigQuery datasets does not grant permissions to anonymous users or make them publicly accessible. Rationale: Granting permissions to allUsers or allAuthenticatedUsers allows unrestricted access to a dataset, which can lead to unauthorized exposure of sensitive data. To maintain data security and privacy, it is crucial to restrict access and avoid granting permissions to these roles. Impact: Datasets will no longer be publicly accessible. Any attempt to make them publicly available will require explicit modification of the IAM permissions. Default Value: By default, BigQuery datasets are not publicly accessible. Audit Steps: ##### Using Google Cloud Console: 1. Navigate to [BigQuery](https://console.cloud.google.com/bigquery).                           ![](https://support.icompaas.com/assets/kb/45760b121e4c0487.png) 2. Select a dataset under Resources.                        ![](https://support.icompaas.com/assets/kb/130db0259608a0f2.png) 3. Click SHARING on the right side of the window and choose Permissions.               ![](https://support.icompaas.com/assets/kb/970bb9ea63ec5f51.png) 4. Verify that no roles include allUsers or allAuthenticatedUsers.            ![](https://support.icompaas.com/assets/kb/f3419d4aa5850ee4.png) ##### Using Google Cloud CLI: List all datasets: bq ls Retrieve the details of each dataset: bq show PROJECT\_ID:DATASET\_NAME 1. Check the access section of the dataset details to ensure that no permissions are granted to allUsers or allAuthenticatedUsers. Remediation Steps: ##### Using Google Cloud Console: 1. Navigate to [BigQuery](https://console.cloud.google.com/bigquery).                        ![](https://support.icompaas.com/assets/kb/f8d70e10fc088a28.png) 2. Select the dataset from Resources.                     ![](https://support.icompaas.com/assets/kb/74e7cb1fd6a2a6c9.png) 3. Click SHARING and choose Permissions.                 ![](https://support.icompaas.com/assets/kb/b60db7606b3dcac8.png) 4. Review the attached roles.                      ![](https://support.icompaas.com/assets/kb/cbe657e183188ecb.png) 5. Remove any entries for allUsers or allAuthenticatedUsers: - Click the delete icon next to the role.           ![](https://support.icompaas.com/assets/kb/7d8a5aed64e159c1.png) - Confirm by clicking Remove.         ![](https://support.icompaas.com/assets/kb/46104994932de4e1.png) ##### Using Google Cloud CLI: List all datasets: bq ls Retrieve the dataset details: bq show --format=prettyjson PROJECT\_ID:DATASET\_NAME > PATH\_TO\_FILE 1. In the access section of the JSON file, remove any roles assigned to allUsers or allAuthenticatedUsers. Update the dataset with the modified JSON: bq update --source PATH\_TO\_FILE PROJECT\_ID:DATASET\_NAME Prevention: To ensure BigQuery datasets do not become publicly accessible in the future: - Set up a Domain Restricted Sharing organization policy: [Restrict Policy Member Domains](https://console.cloud.google.com/iam-admin/orgpolicies/iamallowedPolicyMemberDomains). ## Backout Plan: Step 1: Revert Configuration If dataset access needs to be temporarily restored, re-add necessary permissions: bq update --source dataset\_policy.json PROJECT\_ID:DATASET\_NAME Modify dataset\_policy.json to include the required IAM roles. Step 2: Notify Stakeholders - If rollback is required, inform data engineers and security teams about temporary access adjustments. Step 3: Restore from Backup (If Necessary) - If access configuration issues persist, restore the dataset IAM policy from a previous version. Step 4: Validate Rollback Success - Run the audit steps again to confirm that the intended permissions are restored. References: 1. [BigQuery Dataset Access Controls](https://cloud.google.com/bigquery/docs/dataset-access-controls) CIS Controls:

Control

Description

IG 1

IG 2

IG 3

3.3 Configure Data Access Control Lists

Apply data access controls based on the principle of least privilege for local and remote systems.

✅

✅

✅

14.6 Protect Information through Access Control Lists

Ensure that only authorized users have access to sensitive information based on their responsibilities.

✅

✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.