How to assign Dataplex IAM roles for data engineers and analytic users in a data mesh?
You are designing a data mesh on Google Cloud by using Dataplex to manage data in BigQuery and Cloud Storage. You want to simplify data asset permissions. You are creating a customer virtual lake with two user groups: • Data engineers, which require full data lake access • Analytic users, which require access to curated data You need to assign access rights to these two groups. What should you do?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests whether you understand that Dataplex roles provide unified access to underlying BigQuery and Cloud Storage assets, eliminating the need to manage raw service permissions separately.
Learn how to assign Dataplex IAM roles for a data mesh on Google Cloud. Community consensus confirms that granting dataplex.dataOwner to data engineers at the lake level and dataplex.dataReader to analytic users at the curated zone is the correct approach.
Choosing option C, which grants bigquery.dataOwner and storage.objectCreator directly to data engineers, because it ignores Dataplex's role-based simplification and requires per-service permission management.
Community Discussion (6 comments)
- dataplex.dataOwner: Grants full control over data assets, including reading, writing, managing, and granting access to others. - dataplex.dataReader: Allows users to read data but not modify it.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Granting dataplex.dataOwner to the data engineer group on the customer data lake gives them full control over all data assets, including the ability to read, write, manage, and grant access to others. This matches the requirement for "full data lake access." For analytic users, granting dataplex.dataReader on the curated zone grants read-only access to the curated data, which is exactly what they need. Comment 1 correctly defines these roles, and comment 3 reinforces the two-step approach: dataOwner at the lake level, dataReader at the curated zone level.
Why the Other Options Are Wrong
Option B assigns dataplex.dataReader to data engineers, which only allows read access and does not provide the full data lake access required. Options C and D bypass Dataplex entirely by granting raw BigQuery and Cloud Storage roles. While comment 2 argues that you need permissions on both services, this contradicts the question's goal of "simplifying data asset permissions." Dataplex roles are designed to abstract and manage permissions across BigQuery and Cloud Storage, so using service-specific roles is less efficient and not the intended solution.
Community Comment Notes
The top comment (9 likes) explains the role definitions, supporting answer A. Comment 3 (1 like) explicitly gives the full two-step assignment, confirming the correct configuration. Comment 2 (1 like) proposes option C, but the community overwhelmingly voted for A (94 votes), indicating that the accepted answer is A and that Dataplex-level roles are the right choice for a data mesh with simplified permissions.
Official Reference
Exam Strategy
Look for keywords like "simplify permissions" or "data mesh" and prefer Dataplex-level IAM roles over raw BigQuery or Storage roles. Remember that dataplex.dataOwner at the lake level grants full control, while dataplex.dataReader on a specific zone scopes read-only access for curated data consumers.