This section covers changes between release on the following topics:

• Authorization to the platform
  • User roles
  • Permissions of roles
• Required permissions
• Authentication methods
• User management

Release 8.2

None.

Release 8.1

Fine-grained sharing permissions on individual objects

Beginning in this release, you can change the permissions to a shared object for individual users. These fine-grained permissions can be assigned at the time of sharing by the object's Owner or a workspace admin. They can also be changed at a later time.

For more information, see Overview of Sharing.

Release 8.0

Scheduled outputs now inherit service account settings

Previously, when companion service accounts were enabled for use, outputs for scheduled jobs that had already been created did not inherit the use of the companion service accounts. Without a companion service account, these scheduled outputs cannot be executed, and their jobs would fail with a No Dataflow service account provided error message. The issue and prior workaround are described below.

Beginning in Release 8.0, scheduled outputs that do not have a companion service account inherit the companion service account defined in the user's preferences.

See User Profile Page.

Release 7.10

Changes to IAM roles for service accounts

Recently, Google announced changes to the required permissions for IAM roles used by service accounts to access platform resources.

D s product
product gdppr

customers

Steps:

1. Login as an administrator.
2. From the left nav bar, select User menu > Admin console > Project settings.

3. Locate the following setting: Manage access to data using user IAM permissions. Check the current setting:

   Setting	Description
   Enabled	Users in your deployment are using IAM permissions. Please review and complete the following steps.
   Disabled	Users in your deployment are not affected. No further action is required. See "Other product editions" below for details.
   Default	Default setting is Disabled. See previous.

   For more information, see Dataprep Project Settings Page.

New requirements:

• User must have iam.serviceAccounts.actAs permission on a compute service account, which must be specified during job execution.
• User must have iam.serviceAccounts.actAs permission specified at the project level or in the default compute service account.

• Project owners are not affected.

Recommendations:

For uninterrupted service, please do one of the following:

1. Project administrators can grant their users the iam.serviceAccounts.actAs permission on the default compute service account:
   

   Code Block
   <project-number>-compute@developer.gserviceaccount.com

   
   

2. (preferred) Project administrators should provision compute service accounts of narrower scope for their users. Users should be educated on how to use them.
   

   Warning
   If users are now using companion service accounts, the outputs of any scheduled jobs must be updated. See "Fixing schedules" below.

Fixing schedules:

If individual users are now using companion service accounts to run jobs, all affected schedules must be updated.

Steps:

1. Identify if the flow contains a schedule:
   1. Open the flow in Flow View.
   2. At the top of the page, you may see one of the following icons.
   3. This icon indicates that there is an enabled schedule. Its outputs must be updated. Please see Step 2.
      
      
   4. This icon indicates that there is a schedule, but it is disabled. Its outputs must be updated. Please see Step 2.
      
      
   5. If neither icon is present, then the flow does not have a schedule. Please go to the next flow.
2. For flows that do contain enabled or disabled schedules, please do the following:
   1. Locate the scheduled outputs. In the Flow View canvas, these outputs are labeled Scheduled Output.
   2. Select a scheduled output.
   3. In the right panel, under Scheduled Destinations click Edit.
   4. In the Scheduled publishing settings, click the Advanced Settings caret to open it.
   5. In the Service Account textbox, insert the new companion service account that you should use for the scheduled job.
3. Repeat Step 2 for any other scheduled outputs in the flow.
4. Repeat these steps for other scheduled flows that you own.

References:

• https://cloud.google.com/dataflow/docs/concepts/security-and-permissions#security_and_permissions_for_pipelines_on_google_cloud_platform
• For more information on

  D s product

  permissions, see Required Dataprep User Permissions.
  

Other product editions

No action is required. Actions on

For more information on

Release 7.9

Manage access to data using IAM permissions

You can optionally configure the workspace to manage access to BigQuery and

• This feature must be enabled. See Dataprep Project Settings Page.
• For more information on the required set of IAM permissions, see Required Dataprep User Permissions.

Reduced scope of minimum required permissions

Prior to Release 7.9, the required IAM permissions for

However, many of these previously required permissions do not directly apply to use of the product. Beginning in Release 7.9, the list of required permissions has been reduced to only those required to access the

New permissions

The following permissions are newly tracked for use with

For more information, see Required Dataprep User Permissions.