Connect your app to BigQuery

1. 1

   Decide how you want to connect: 'Connect with Google' for quick setup using your personal Google account, or 'Workload Identity Federation' for production and team-managed access.

   Your choice determines the setup process and how access is managed. 'Connect with Google' is faster for individuals, while 'Workload Identity Federation' is more secure and scalable for teams.

2. 2

   If using 'Connect with Google': Go to 'Connectors' in Lovable, select 'BigQuery', click 'Add connection', give it a name, choose 'Connect with Google', enter your Google Cloud project ID, decide who can use the connection, and then click 'Connect' to sign in with your Google account.

   This links your Lovable app to BigQuery using your Google account's permissions, allowing you to query data in the specified Google Cloud project.

3. 3

   If using 'Workload Identity Federation': Open Google Cloud Shell Editor, select your Google Cloud project, create a new file (e.g., `setup.sh`), paste the provided script, and fill in `GCP_PROJECT`, `WORKSPACE_ID` (from Lovable's connection form), and `ALLOWED_DATASETS`.

   This script sets up the necessary Google Cloud components (Workload Identity Pool, OIDC provider, service account) that allow Lovable to securely access your BigQuery data without using long-lived keys.

4. 4

   Run the script in Google Cloud Shell Editor, confirm the changes when prompted, and then copy the output values for 'Service Account Email' and 'Audience'.

   The script configures Google Cloud, and the output provides the credentials you'll need to complete the connection in Lovable.

5. 5

   In Lovable, go to 'Connectors', select 'BigQuery', click 'Add connection', give it a name, choose 'Use your own credentials', paste the 'Service Account Email' and 'Audience' from the script output, and decide who can use the connection.

   This completes the connection in Lovable, linking your app to BigQuery through the secure Workload Identity Federation setup you configured in Google Cloud.

I need to connect my Lovable app to Google BigQuery. I want to use Workload Identity Federation for this connection. My Google Cloud project ID is 'my-gcp-project-123', my Lovable workspace ID is 'ws-abcde12345', and I want to allow access to datasets 'my_analytics_data' and 'my_reporting_data'. Please provide the full script I need to run in Google Cloud Shell Editor to set this up.

Workload Identity Federation (WIF)

A secure way for services outside of Google Cloud (like Lovable) to access Google Cloud resources without needing to store special secret keys. Instead, they exchange temporary identity tokens.

OAuth

A standard way for you to give one service (like Lovable) permission to access your information on another service (like Google) without sharing your password.

Service Account

A special Google account used by applications and services, not by a person. It has its own permissions to access Google Cloud resources.

Google Cloud project ID

A unique identifier for your project in Google Cloud, which acts as a container for all your Google Cloud resources like BigQuery datasets.

IAM permissions

Rules that define who (or what service account) can do what actions on which resources in Google Cloud. For example, who can read data from a BigQuery table.

Connector gateway

A secure service that Lovable uses to handle connections to other apps and services, managing things like temporary access tokens.

Scope

Defines the specific permissions an application is asking for when you grant it access to your Google account or resources (e.g., permission to view BigQuery data).

OIDC provider

A service that verifies the identity of users or applications using a standard protocol called OpenID Connect.

• Not having the correct Google Cloud permissions (e.g., BigQuery Job User role) for the account or service account you are using to connect.
• Forgetting to enable necessary Google Cloud APIs (like IAM, STS, IAM Credentials, BigQuery) when setting up Workload Identity Federation.
• Incorrectly setting the `GCP_PROJECT`, `WORKSPACE_ID`, or `ALLOWED_DATASETS` variables in the Workload Identity Federation setup script.
• Blocking pop-ups in your browser, which will prevent the Google sign-in window from opening when using 'Connect with Google'.
• Granting too many or too few IAM roles to the connected identity, which can either create security risks or prevent your app from functioning correctly.
• Not fully qualifying table names (e.g., `data-project.dataset.table`) when reading data from a different Google Cloud project than the one running your queries.