What is Google's Service Account (GSA) Key?

Please refer to this document for the explanation on GSA.


Request for Google's Service Account to be used for the Looker Studio's Dashboard

Before you change the BigQuery connection on the Looker Studio Dashboard, you will need to have a GSA created with the correct permission granted to access the data for the dashboard.

  1. Submit a request for the creation of GSA (without key) on the required GCP Project that has the data with the following:
    1. Naming convention: sa-looker-<dashboard's name>
    2. In order for Looker Studio to manage the GSA key, permission to be granted on this service account:
      1. Allow this GSA service-org-858733915357@gcp-sa-datastudio.iam.gserviceaccount.com (Looker Studio's GSA on the organization level) with following permission:
        1. Service Account User
        2. Service Account Token Creator
    3. On the resources, grant the following permission (recommended to grant only at the dataset's level):
      1. BigQuery Data Viewer
  2. Once the GSA is created, you will need the email of the GSA the connection in the next step. 


Looker Studio's BigQuery connection can only work with GCP and Looker Studio within the same organization.

Changing existing BigQuery connection on Looker Studio

Looker Studio Users are advised to use Google Cloud Project Service account to bind with the Looker Studio Project as illustrated below:

#

Description

Remarks

1

Edit the existing Data binding account.

Go to Looker Studio → Data → Click Edit 

(as illustrated in the print screen on the right)


Click on the "Data credentials"


Choose the "Service Account Credentials" and fill in with the target service account.

(Click Update button to update the config)

Why I cannot see the "Service Account Credentials" when trying to create a new connection?

If you are not able to see the "Service Account Credentials", follow the following steps:

  1. Add a Bigquery connection with your own account.
  2. After added the connection, change the data connection as per the section on "Changing existing BigQuery connection on Looker Studio".
    The "Service Account Credentials" will be shown.


How often do I need to rotate my service account key?

The GSA used for Looker Studio will not require to create a user-managed service account key. 
Therefore, you do not need to rotate the GSA key.