GCP

Upriver connects to Google Cloud through a read-only service account that lives in your own project. You create it by downloading a Terraform file from the connector card in Upriver and running it yourself — the file is pre-filled from the answers you give in the UI, so there is nothing to request from an Upriver representative and nothing to send back by email.

Two GCP services connect this way, each with its own guide:

Service	What Upriver does with it
BigQuery	Monitors datasets and tables for data quality, builds lineage, and lets the agent run read-only queries during triage
Cloud Composer	Reads DAGs, run history, task logs and import errors, so incidents can be traced to the pipeline that caused them

One run can cover both. Each connector's first step has a checkbox to also connect the other service in the same Terraform run, so your security team reviews one change instead of two. BigQuery and Composer may live in different projects — you list every project Upriver should read from during setup.

---

How access works

1. The Terraform you run creates a dedicated service account in your project, owned by you, and grants it read-only roles on the projects (and, if you choose, the specific datasets and tables) you named.

2. It grants Upriver's platform service account roles/iam.serviceAccountTokenCreator on that one service account. Upriver then authenticates by impersonating it with short-lived tokens.

3. There is no service account key — none is created, and the product has no key upload path. There is no long-lived credential to leak or rotate.

4. Revoking is entirely on your side: remove that one binding, or run terraform destroy.

The complete role list — every role, where it is granted and what it is used for, including an honest note on the audit-log access that lineage depends on — is in BigQuery Permissions. It is written to be diffed against your terraform plan output.

---

Google Cloud Storage

The self-serve setup above covers BigQuery and Cloud Composer only — it grants no Cloud Storage roles. Monitoring data in GCS buckets uses the same read-only service account, but the access to the buckets is arranged with your Upriver representative. Once that is in place, buckets are configured per data source, as described on the Google Cloud Storage (GCS) page.

Enabling access management on a GCS folder

To scope Upriver to specific folders inside a bucket rather than the whole bucket, the folder has to be a managed folder. How to enable that from the Cloud Console:

---

Hybrid deployments

In a hybrid deployment Upriver runs the monitoring from a Databricks workspace created inside one of your projects, rather than from Upriver's SaaS. That model needs permissions well beyond the read-only setup above — including the ability to create service accounts, buckets and compute in a project dedicated to Upriver — so it is planned together with your Upriver representative rather than self-served. The read-only data viewer service account is created the same way; only the impersonation path differs, since Upriver can then impersonate it solely from the workspace in your project.