Terraform Scripts

For organization discovery, use the organization-level Terraform configuration on the GCP page.

For manual project enrollment, grant the BigQuery roles to the connector service account on each enrolled project:

resource "google_project_iam_custom_role" "teleskope_gcp_dispatch" {
  project_id  = var.project_id
  role_id     = "teleskope_gcp_dispatch"
  title       = "Teleskope GCP dispatch"
  description = "Read the enrolled project and its regions before connector dispatch"

  permissions = [
    "resourcemanager.projects.get",
    "compute.regions.list",
  ]
}

resource "google_project_iam_member" "teleskope_gcp_dispatch" {
  project = var.project_id
  role    = google_project_iam_custom_role.teleskope_gcp_dispatch.name
  member  = "serviceAccount:${google_service_account.teleskope.email}"
}

resource "google_project_iam_member" "teleskope_bigquery" {
  for_each = toset([
    "roles/bigquery.jobUser",
    "roles/bigquery.metadataViewer",
    "roles/bigquery.dataViewer",
  ])

  project = var.project_id
  role    = each.value
  member  = "serviceAccount:${google_service_account.teleskope.email}"
}

The BigQuery roles above supply bigquery.datasets.get, bigquery.tables.get, bigquery.tables.list, bigquery.tables.getData, and bigquery.jobs.create. See GCP organization discovery for the complete API-to-permission matrix and preflight coverage.

For BigQuery deletion or masking workflows, add roles/bigquery.dataEditor.