> For the complete documentation index, see [llms.txt](https://docs.teleskope.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.teleskope.ai/connectors/gcp/bigquery/terraform-scripts.md).

# Terraform Scripts

For organization discovery, use the organization-level Terraform configuration on the [GCP](/connectors/gcp.md) page.

For manual project enrollment, grant the BigQuery roles to the connector service account on each enrolled project:

```hcl
resource "google_project_iam_custom_role" "teleskope_gcp_dispatch" {
  project_id  = var.project_id
  role_id     = "teleskope_gcp_dispatch"
  title       = "Teleskope GCP dispatch"
  description = "Read the enrolled project and its regions before connector dispatch"

  permissions = [
    "resourcemanager.projects.get",
    "compute.regions.list",
  ]
}

resource "google_project_iam_member" "teleskope_gcp_dispatch" {
  project = var.project_id
  role    = google_project_iam_custom_role.teleskope_gcp_dispatch.name
  member  = "serviceAccount:${google_service_account.teleskope.email}"
}

resource "google_project_iam_member" "teleskope_bigquery" {
  for_each = toset([
    "roles/bigquery.jobUser",
    "roles/bigquery.metadataViewer",
    "roles/bigquery.dataViewer",
  ])

  project = var.project_id
  role    = each.value
  member  = "serviceAccount:${google_service_account.teleskope.email}"
}
```

The BigQuery roles above supply `bigquery.datasets.get`, `bigquery.tables.get`, `bigquery.tables.list`, `bigquery.tables.getData`, and `bigquery.jobs.create`. See [GCP organization discovery](/connectors/gcp.md#runtime-iam-requirements) for the complete API-to-permission matrix and preflight coverage.

For BigQuery deletion or masking workflows, add `roles/bigquery.dataEditor`.