## How BigQuery connection works

To set up a connection with BigQuery, there are two supported methods:

* Grant Permissions to a Statsig-owned Service Account
* Provide Credentials for Your Own First-Party Service Account

In both cases, you need:

* Your BigQuery Project ID
* The dataset Statsig uses to save temporary tables and materialized results

After you choose your method, start by enabling the BigQuery source in your project settings.

## Grant permissions to Statsig's service account

Grant Statsig access to your BigQuery data from your Google Cloud console.

1. In your BigQuery's [IAM & Admin settings](https://console.cloud.google.com/iam-admin/), add the Statsig service account you copied in the Statsig Console as a new principal for your project and give it the following roles:
   * `BigQuery User`

{% figure %}
![BigQuery IAM permissions configuration](/images/statsig-warehouse-native/connecting-your-warehouse/bigquery/198107543-b3bcc19a-3231-4128-be42-a5dd52fb168a.png)
{% /figure %}

<br />

2. Navigate to your [BigQuery SQL Workspace](https://console.cloud.google.com/bigquery), choose the dataset, click **+ Sharing** > **Permissions** > **Add Principal**, and give the same Statsig service account the "BigQuery Data Viewer" role. Repeat for any datasets you want the service user to access.

   {% figure %}
   ![BigQuery dataset permissions interface](/images/integrations/data-imports/bigquery/175113611-90e618ad-f6e8-4005-933e-2a5660a14466.png)
   {% /figure %}

3. Repeat step 2 to give the "BigQuery Data Editor" role on the dataset Statsig uses for staging data.

{% callout type="info" %}
If your data warehouse is IP protected, you must include allowlisting of Statsig IP ranges in your setup steps.
{% /callout %}

The service account has the required permissions to run queries and materialize results.

## Using a first-party service account

{% callout type="warning" %}
This method isn't recommended. Using service accounts is the [preferred option for enhanced security](https://docs.cloud.google.com/iam/docs/migrate-from-service-account-keys).
{% /callout %}

1. On the BQ service accounts page, click 'Manage Keys' for the service account you want to use

{% figure %}
![BQ 1st party service account](/images/1stprtybq.png)
{% /figure %}

2. Create a new JSON key (which will download a JSON file)

   {% figure %}
   ![BQ 1st party service account](/images/1stprtybq2.png)
   {% /figure %}

   {% figure %}
   ![BQ 1st party service account](/images/1stprtybq3.png)
   {% /figure %}

3. In the **Statsig Settings** -> [Data Connection](https://console.statsig.com/data_connection/connection_setup) tab, paste the above key into the **Service Account Private Key** field under the **Advanced** toggle.

## Additional BigQuery resources

### BigQuery project ID

Find your BigQuery Project ID:

1. Click on your Project Dropdown inside your Cloud Console.

{% figure %}
![Frame 4](/images/statsig-warehouse-native/connecting-your-warehouse/bigquery/187518062-7027f682-d1fd-445e-9947-897e44ea929e.png)
{% /figure %}

2. Copy and paste relevant Project ID from the modal pop-up.

{% figure %}
![Frame 5](/images/statsig-warehouse-native/connecting-your-warehouse/bigquery/187517901-9e7fd237-8325-4254-a1bd-c75f0ea08497.png)
{% /figure %}

{% callout type="info" %}
If your data warehouse is IP protected, you must include allowlisting of Statsig IP ranges in your setup steps.
{% /callout %}

### Statsig Customer ID on BigQuery

C01d5f80s

### IP addresses Statsig accesses data warehouses from

[Go to FAQ](/data-warehouse-ingestion/faq#what-ip-addresses-will-statsig-access-data-warehouses-from)

### Additional setup for Warehouse Explorer

Warehouse Explorer lets you find and bring data from any table into Statsig for ad-hoc analysis.

Statsig reads from `INFORMATION_SCHEMA.COLUMNS`, which requires explicit permission to view table metadata. Grant access by repeating steps 1 and 2 from the [Grant Permissions](/statsig-warehouse-native/connecting-your-warehouse/bigquery#grant-permissions-to-statsig%E2%80%99s-service-account) section for the "BigQuery Metadata Viewer" role.