---
title: BigQuery Dataset should not be anonymously or publicly accessible
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > BigQuery Dataset should not be
  anonymously or publicly accessible
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# BigQuery Dataset should not be anonymously or publicly accessible
 
## Description{% #description %}

BigQuery datasets should not allow anonymous or public access. Granting a role to `allUsers` or `allAuthenticatedUsers` allows anyone, or anyone with a Google account, to access the dataset, which can expose sensitive data. This rule fails a dataset when either principal is granted any role, predefined or custom, in a binding of the dataset's IAM policy or in a dataset access entry (`specialGroup` or `iamMember`). Dataset IAM policy bindings are the primary source for this check; access entries are evaluated only when they are present in the collected dataset configuration. Public access granted at the project, folder, or organization level is not evaluated by this rule.

## Remediation{% #remediation %}

1. In the [BigQuery console](https://console.cloud.google.com/bigquery), open the dataset, click **Sharing** > **Permissions**, and remove every role granted to `allUsers` or `allAuthenticatedUsers`. This removes them from the dataset's IAM policy.
1. To use the CLI instead, write the dataset's access policy to a file with `bq show --format=prettyjson PROJECT_ID:DATASET_NAME > PATH_TO_FILE`. For datasets, this `access` list is the IAM policy: `bq get-iam-policy` and `bq remove-iam-policy-binding` do not support datasets ([bq command-line tool reference](https://docs.cloud.google.com/bigquery/docs/reference/bq-cli-reference)).
1. Delete every `access` entry whose `specialGroup` or `iamMember` is `allUsers` or `allAuthenticatedUsers`, then run `bq update --source PATH_TO_FILE PROJECT_ID:DATASET_NAME`. Follow [Revoke access to a dataset](https://docs.cloud.google.com/bigquery/docs/control-access-to-resources-iam#revoke_access_to_a_dataset) for the documented procedure.

## References{% #references %}

1. [Control access to resources with IAM](https://docs.cloud.google.com/bigquery/docs/control-access-to-resources-iam)
1. [bq command-line tool reference](https://docs.cloud.google.com/bigquery/docs/reference/bq-cli-reference)
1. [CIS Google Cloud Platform Foundation Benchmark](https://www.cisecurity.org/benchmark/google_cloud_computing_platform)
1. [Revoke access to a dataset](https://docs.cloud.google.com/bigquery/docs/control-access-to-resources-iam#revoke_access_to_a_dataset)