Fixing BigQuery connection errors from a Compute Engine VM

PCA By islever Editorial Last updated

Configuring compute systems. Designing for security.

Short answer

C Create a service account with BigQuery IAM access and run the Python script authenticated as that user to fix the connection errors.

Question

You write a Python script to connect to Google BigQuery from a Google Compute Engine virtual machine. The script is printing errors that it cannot connect to
BigQuery.
What should you do to fix the script?
  1. Install the latest BigQuery API client library for Python
  2. Run your script on a new virtual machine with the BigQuery access scope enabled
  3. Create a new service account with BigQuery access and execute your script with that user Correct Answer
  4. Install the bq component for gcloud with the command gcloud components install bq.

Key Takeaways

The question tests Compute Engine authentication and authorization; the trap is confusing legacy instance access scopes with the recommended service-account-plus-IAM model.

A Python script on Compute Engine failing to connect to BigQuery needs proper identity and authorization, not a new library or CLI tool. The fix is option C: run the script as a service account granted BigQuery access through IAM.

Common mistake: Option B is the tempting wrong answer because access scopes do gate API calls from a VM, but they are a legacy mechanism, cannot justify creating an entire new VM, and IAM roles on a service account are the current recommended fix.

Expert Analysis

Reading the failure wording The question says the script "is printing errors that it cannot connect to BigQuery." That phrasing is the key qualifier: the script launches, imports, and reaches the point where it calls the BigQuery API. A missing Python client library would fail earlier with an ImportError or ModuleNotFoundError, so option A is eliminated — the library is evidently installed. Option D is also irrelevant: the bq component of gcloud is the interactive CLI tool, and installing it changes nothing for a Python script using the API client.

Scopes versus service accounts That leaves B and C. Option B tells you to "create a new virtual machine" with the BigQuery access scope enabled. Access scopes are a legacy, instance-level mechanism that sets the default OAuth scopes for requests leaving the VM, they are assigned at instance creation, and editing them requires stopping the instance. Spinning up an entire replacement VM to repair a permissions problem is disproportionate, and Google's current guidance is that IAM roles — not scopes — define what an identity can do. So B is a distractor built on the deprecated model.

The correct fix Option C matches the supported path: create a service account, grant it BigQuery access (for example roles/bigquery.jobuser plus data access as needed), and run the script authenticated as that user — via GOOGLE_APPLICATION_CREDENTIALS or Application Default Credentials. The community comments converge here too, noting that scopes only constrain the default Compute service account while a properly IAM-granted service account fixes authorization directly. C is the answer.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question describes a runtime failure, read the exact error stage: "cannot connect" implies the code runs, so library-installation options are dead. Then compare identity mechanisms — treat anything proposing a legacy feature (access scopes) or a disproportionate rebuild (a new VM) as a distractor, and pick the option that grants IAM permissions to the identity actually running the workload.

Frequently Asked Questions

Why doesn't installing the BigQuery Python client library fix this error?

Because the script already runs and reaches the connection step — a missing library would fail at import time with ModuleNotFoundError. The failure is authorization, not missing dependencies.

Are Compute Engine access scopes still a valid way to grant BigQuery access?

Access scopes are a legacy mechanism set at instance creation and only define default OAuth scopes for the VM's requests. Google recommends granting IAM roles to the instance's service account instead.

How do I run a Python script on a VM as a specific service account?

Attach the service account to the instance and use Application Default Credentials, or export GOOGLE_APPLICATION_CREDENTIALS pointing to a downloaded service account key file before running the script.

More PCA FAQ →

Community Votes

C
71%
B
24%
A
5%

71% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 189 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 189

  1. kalschi 👍 102
    A - If client library was not installed, the python scripts won't run - since the question states the script reports "cannot connect" - the client library must have been installed. so it's B or C. B - https://cloud.google.com/bigquery/docs/authorization an access scope is how your client application retrieve access_token with access permission in OAuth when you want to access services via API call - in this case, it is possible that the python script use an API call instead of library, if this is true, then access scope is required. client library requires no access scope (as it does not go through OAuth) C - service account is Google Cloud's best practice So prefer C.
  2. cloudguy1 👍 37
    Stop confusing people, B) doesn't make any sense. Why would you use or create a whole new VM just because of a permission issue? If anything, just stop the instance and edit the scope of the default Compute Service Account and grant it the role through IAM. C) is the most appropriate answer since you can only set scopes of the default Compute Service Account, if you're using any other, there's no scope option - its access is dictated strictly by IAM in such scenario. So C) is the answer: Stop the VM, change the Service Account with the appropriate permissions and done. B) would still need to have permission the set through IAM & Admin, the scope isn't enough with the default Compute Service Account.
  3. tartar 👍 16
    Sorry, B is ok. You can create service account, add user to service account, and grant the user role as Service Account User. You still need to enable BigQuery scope to make the Python script running the instance to access BigQuery.
  4. KouShikyou 👍 14
    Why not B? It looks better for me.
  5. rishab86 👍 11
    Access scopes are the legacy method of specifying permissions for your instance. read from > https://cloud.google.com/compute/docs/access/service-accounts . So , I would go with C
Show 25 more comments
  1. JoeShmoe 👍 8
    B is correct. New VM has access scope only to read storage so need to add additional access scopes. Can only do that when instance is stopped (go try it in console in vm create under access scopes for API's)
  2. jaxclain 👍 7 Answered C
    Always always always pick Google Best Practices for GCP Exams lol I have about 7+ years working as a Google Workspace Deployment specialist and internally we use Best Practices so even if creating a new VM could fix the issue, the option will still be C (Create a new service account with bq access and execute the script with it) lol not sure why some here still fight against Best Practices during exams.. https://cloud.google.com/iam/docs/best-practices-service-accounts
  3. desertlotus1211 👍 7
    Answer is C: https://cloud.google.com/bigquery/docs/authentication A service account is a Google account that is associated with your GCP project. USE a service account to access the BigQuery API if your application can run jobs associated with service credentials rather than an end-user's credentials, such as a batch processing pipeline
  4. VinMoc 👍 7
    https://cloud.google.com/bigquery/docs/quickstarts/quickstart-client-libraries C is the best answer, you need to create a NEW SERVICE ACCOUUNT
  5. techalik 👍 6
    Configure the Python API to use a service account with relevant BigQuery access enabled. is the right answer. It is likely that this service account this script is running under does not have the permissions to connect to BigQuery and that could be causing issues. You can prevent these by using a service account that has the necessary roles to access BigQuery. Ref: https://cloud.google.com/bigquery/docs/reference/libraries#cloud-console A service account is a special kind of account used by an application or a virtual machine (VM) instance, not a person. Ref: https://cloud.google.com/iam/docs/service-accounts
  6. nitinz 👍 6
    C, no brainer. You need SA for using API period. Thats where your start your troubleshooting.
  7. RitwickKumar 👍 5
    Selected Answer: C Source: https://stackoverflow.com/questions/64559636/what-is-the-difference-between-service-account-roles-and-access-scopes-in-gcp Access scopes are legacy/pre IAM way of giving permissions where as custom service accounts are recommended now. Read through this text: The Service Account ACCESS SCOPES are the Legacy methods of specifying permissions for your instance and they are used in substitutions of IAM roles. They you used specifically for default or automatically created service accounts based on enabled APIs. Before the existence of IAM roles the Access Scopes were the only way for granting permissions to the service accounts , although they are not the primary way of granting permissions now , you must still set service account access scopes when configuring an instance to run as a service account. However when you are using a custom service account you will not be using access scopes rather you will be using IAM Roles. So when you are using a default Service Account for your compute Instance it will default to use scopes instead of IAM roles.
  8. asheesh0574 👍 5
    Not sure what you want to say. You started by saying that B makes all sense and then you concluded by saying that Answer is definitely C. As per Braincert , answer should be B
  9. iamgcp 👍 5
    C is correct. When you don't use a default service account, but use a custom service account you don't need to assign the scope. Scope is the legacy way of doing it.
  10. gc04 👍 4
    B is correct. Giving the service account permissions does no good if the GCE instance itself is blocked: "You must set access scopes on the instance to authorize access. While a service account's access level is determined by the IAM roles granted to the service account, an instance's access scopes determine the default OAuth scopes for requests made through the gcloud tool and client libraries on the instance. As a result, access scopes potentially further limit access to API methods when authenticating through OAuth.You must set access scopes on the instance to authorize access. While a service account's access level is determined by the IAM roles granted to the service account, an instance's access scopes determine the default OAuth scopes for requests made through the gcloud tool and client libraries on the instance. As a result, access scopes potentially further limit access to API methods when authenticating through OAuth." Source: https://cloud.google.com/compute/docs/access/service-accounts#usingroles
  11. lucaluca1982 👍 4 Answered C
    Service accounts provide a way to authenticate your application to Google Cloud services. When you create a service account, you can assign it specific roles that dictate what resources the service account can interact with, and how it can interact with them. In this case, you would assign the BigQuery access role to the service account, which would then be used to authenticate your script to BigQuery.
  12. markus_de 👍 4 Answered B
    C sounds good but I struggle with the wording "execute script". The script itself is not executed with the service account. But what is the case that if the VM is started without Access Scope for BigQuery it wan't work. And the problem is GCP does not allow to update access scopes on an already running instance. That means B ist the better answer as aa new VM is needed to enable Access Scope,
  13. Ashath 👍 4
    Google says "A best practice is to set the cloud-platform access scope on the instance, then control the service account's API access with IAM roles" https://cloud.google.com/compute/docs/access/service-accounts#accesscopesiam So I would go C not B
  14. certificatores 👍 4
    cloud guy1, relax. tartar is the hero for google cloud and if you read his answer, he explains the service account user's role granting on this one as that is the best practice
  15. iamgcp 👍 4
    Why not C? Just shut down the machine and edit it, to attach the new Service account with BigQuery Access. In option B you need to create a new VM and reinstall everything.
  16. gauravagrawal 👍 4
    Right.. B might be right only if C was not the option. so i will go with C as it's recommended google's best practice.
  17. Ashoks 👍 4
    I will go with B. Since it is connection error, API needs to be enabled
  18. KouShikyou 👍 4
    If lib is not installed, python should return import error.
  19. Vika 👍 4
    agreed to comment here . C seems like a good option
  20. AD2AD4 👍 4
    Final Decision to go with Option C
  21. Musk 👍 4
    Might be an old version
  22. a2le 👍 3 Answered C
    Tricky question. However, as you can read in gcloud compute instances create documentation: --scopes=[SCOPE,…] If not provided, the instance will be assigned the default scopes, described below. However, if neither --scopes nor --no-scopes are specified and the project has no default service account, then the instance will be created with no scopes. Note that the level of access that a service account has is determined by a combination of access scopes and IAM roles so you must configure both access scopes and IAM roles for the service account to work properly. So, probably, B is the right one, as for the "new vm", I guess that this is because you don't want to stop the current one before having the working one ready...
  23. JohnWick2020 👍 3
    Answer - C. Solution flow: GCE VM (Python script) > BigQuery Keynotes from question: 1 - Script printing errors ... cannot connect to BIgQuery (permission issue!) 2 - What should you do to "Fix the script" <<--- Very important Explanations: A - incorrect; assume API client library is installed else script throws a different exception. B - incorrect; no need for a new VM; C - correct; use a managed identity (SA) and use this in (fix!) your script. Less overhead longer-term. If you need to expand scope, tweak SA permissions without touching code. D - incorrect; not applicable as you still have the permission issue.
  24. santoshchauhan 👍 3 Answered C
    C. Create a new service account with BigQuery access and execute your script with that user. Service accounts are used for server-to-server interactions, such as those between a virtual machine and BigQuery. You would need to create a service account that has the necessary permissions to access BigQuery, then download the service account key in JSON format. Once you have the key, you can set an environment variable (GOOGLE_APPLICATION_CREDENTIALS) to the path of the JSON key file before running your script, which will authenticate your requests to BigQuery.
  25. Eroc 👍 3
    "A" The BigQuery API API client library for Python is used to get BigQuery running using a Computer Engine VM, it should be the best vesion. Both "B" and "C" are referring to setting teh correct permissions for the account that executes the script, if the permissions are not correct it will not connect. Since service accounts are Google's best practice, "C" is better than "B" because "B" increases the risk of increased CPU usage costs. "D" installs the correct software within the VM you are configuring, the API mitigates this. Correct Answer: "A"

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Multi-Regional vs Regional Cloud Storage for Global Software Downloads

S-grade

Surviving a Zone Outage With SQL Server on GCP

S-grade

Moving 75 TB into Cloud Storage with Google-recommended practices

S-grade

Optimizing Cost and Persistence for Interruptible Batch AI Workloads on Google Cloud

S-grade

Practice All PCA Questions

Access 81 questions with complete answers and detailed explanations.

View Full PCA Practice Test →

← Back to PCA Study Guide