Protect your BigQuery data in Data Studio by using VPC Service Controls and service accounts. You can enforce IP-based access levels and configure dedicated credentials that support automated reporting.
Support for VPC Service Controls
Data Studio can connect securely to BigQuery projects that are protected by VPC Service Controls (VPC-SC) perimeters. The connector passes the report viewer's end-user IP address to BigQuery, allowing Google Cloud to enforce any configured viewer IP-based access levels.
Limits of VPC Service Controls
By default, automated background deliveries—such as scheduled email snapshots, threshold alerts, and scheduled data extracts—don't work with datasets that are protected solely by IP-based access levels. Because background tasks don't run from an end-user IP address, VPC Service Controls blocks the request.
To use automated reporting features behind VPC Service Controls perimeters, configure your data source connection to use service account credentials or create an access level that allows background requests.
Because Data Studio runs on Google-managed infrastructure with dynamic IP addresses and project allocations, you can't configure VPC Service Controls perimeters by using static IP allowlists or project rules. To permit Data Studio access through a VPC Service Controls perimeter, you must add a service account as a principal in your access levels or ingress and egress rules.
Set up a Google Cloud service account
Service accounts prevent reports from breaking if an employee leaves the company, and they allow secure network access inside VPC-SC perimeters. Instead of delegating access by using Owner's credentials, or requiring individual report viewers to have access to the data by using Viewer's credentials, administrators can configure a dedicated Google Cloud service account to query data.
To review required role assignments (roles/bigquery.dataViewer, roles/bigquery.jobUser) and setup steps in the Google Cloud console, see Set up a Google Cloud service account for Data Studio.