Simplifying Permissions with Dataplex Roles

PDE By islever Editorial Last updated

Planning the data pipelines. Designing for a data platform.

Short answer

A Grant the dataplex.dataOwner role to the data engineer group on the customer data lake and the dataplex.dataReader role to the analytic user group on the customer curated zone to simplify permissions via Dataplex.

Question

You are designing a data mesh on Google Cloud by using Dataplex to manage data in BigQuery and Cloud Storage. You want to simplify data asset permissions. You are creating a customer virtual lake with two user groups:
• Data engineers, which require full data lake access
• Analytic users, which require access to curated data
You need to assign access rights to these two groups. What should you do?
    1. Grant the dataplex.dataOwner role to the data engineer group on the customer data lake. 2. Grant the dataplex.dataReader role to the analytic user group on the customer curated zone.
    Correct Answer
    1. Grant the dataplex.dataReader role to the data engineer group on the customer data lake. 2. Grant the dataplex.dataOwner to the analytic user group on the customer curated zone.
    1. Grant the bigquery.dataOwner role on BigQuery datasets and the storage.objectCreator role on Cloud Storage buckets to data engineers. 2. Grant the bigquery.dataViewer role on BigQuery datasets and the storage.objectViewer role on Cloud Storage buckets to analytic users.
    1. Grant the bigquery.dataViewer role on BigQuery datasets and the storage.objectViewer role on Cloud Storage buckets to data engineers. 2. Grant the bigquery.dataOwner role on BigQuery datasets and the storage.objectEditor role on Cloud Storage buckets to analytic users.

Key Takeaways

The trap is selecting standard storage IAM roles (BigQuery/Storage) when the prompt specifically asks to 'simplify' permissions using Dataplex, which acts as an abstraction layer.

To simplify data asset permissions in a Dataplex-managed data mesh, use Dataplex-specific IAM roles like dataplex.dataOwner and dataplex.dataReader instead of granular storage service roles.

Common mistake: Option C is incorrect because it assigns native BigQuery and Cloud Storage IAM roles directly. While these provide access, they do not leverage Dataplex's centralized governance features, failing to meet the 'simplify' requirement.

Expert Analysis

The question explicitly states the goal is to simplify data asset permissions within a Dataplex-managed environment. This phrasing is the critical discriminator. While Option C lists valid IAM roles for BigQuery and Cloud Storage, granting them directly bypasses Dataplex's abstraction layer, resulting in complex, redundant permission management across multiple resources.

Dataplex provides specific IAM roles designed to manage access at the Lake and Zone level, which then map to underlying storage permissions. According to Google Cloud documentation, the dataplex.dataOwner role grants full control over data assets (read, write, manage), which aligns perfectly with the Data Engineers' requirement for 'full data lake access'. Conversely, the dataplex.dataReader role allows users to read data but not modify it, matching the Analytic Users' need for 'access to curated data'.

Comments highlight this distinction: one notes that ignoring the 'simplify permissions' detail leads away from Dataplex-specific roles. Another confirms that Dataplex maps its roles to underlying data roles, serving as the simplification mechanism. Therefore, assigning Dataplex-level roles (Option A) is the architecturally correct choice for managing permissions centrally via Knowledge Catalog, whereas Option C represents a manual, non-simplified approach.

Official Reference

https://cloud.google.com/dataplex/docs/lake-security#data-roles

This link opens the official vendor documentation in a new tab.

Exam Strategy

When exam questions mention 'simplify', 'centralize', or 'governance' in the context of Dataplex or Knowledge Catalog, prioritize Dataplex-specific IAM roles (dataOwner, dataReader, dataEditor) over raw service roles. These higher-level roles abstract the complexity of underlying resource permissions, directly addressing the operational efficiency goal stated in the scenario.

Frequently Asked Questions

Why not grant direct BigQuery and Storage roles?

Directly granting roles on individual datasets and buckets creates a fragmented permission model. Dataplex roles allow you to manage access at the Lake or Zone level, automatically mapping to underlying resources, which significantly reduces administrative overhead.

What is the difference between dataplex.dataOwner and dataReader?

dataplex.dataOwner grants full control including reading, writing, and managing assets. dataplex.dataReader only allows reading data assets without modification rights, suitable for analysts who consume but do not create data.

More PDE FAQ →

Community Votes

A
83%
C
17%

83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. raaad 👍 9 Answered A
    - dataplex.dataOwner: Grants full control over data assets, including reading, writing, managing, and granting access to others. - dataplex.dataReader: Allows users to read data but not modify it.
  2. AllenChen123 👍 4
    Yes, https://cloud.google.com/dataplex/docs/lake-security#data-roles Dataplex maps its roles to the data roles for each underlying storage resource (Cloud Storage, BigQuery). ^ simplify the permissions.
  3. qq589539483084gfrgrgfr 👍 3 Answered A
    A correct answer
  4. Matt_108 👍 2 Answered A
    Option A clearly correct
  5. renshoo_shimasho 👍 1
    Don't overlook this detail in the question. "You want to simplify data asset permissions." This focuses the question on the management of the Lakes and Zones in Knowledge Catalog formely know as Dataplex. The answer can't be C with that additional context.
Show 3 more comments
  1. scaenruy 👍 1 Answered A
    A. 1. Grant the dataplex.dataOwner role to the data engineer group on the customer data lake. 2. Grant the dataplex.dataReader role to the analytic user group on the customer curated zone.
  2. josech 👍 1 Answered C
    The quetion is for BigQuery AND Cloud Storage for a Data Lake, so you should assign IAM permissions for both of them. C is correct.
  3. JyoGCP 👍 1 Answered A
    Option A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to establish consistent BigQuery spend?

S-grade

Triggering Airflow DAGs Reactively in Private Cloud Composer

S-grade

How to resolve Cloud Composer 2 worker pod evictions and task failures?

S-grade

Ensuring Consistency in BigQuery Streaming Analytics

S-grade

← Back to PDE Study Guide