Permissions
2 IAM roles. Read-only. That's it.
Lighthouse only reads metadata — job history, storage stats, slot usage. It cannot access your actual table data, run queries, create objects, or modify anything in your BigQuery project.
Job History Access
roles/bigquery.resourceViewer
One-time IAM grant. Covers all current and future jobs automatically.
gcloud projects add-iam-policy-binding PROJECT_ID \
--member="serviceAccount:lighthouse@PROJECT_ID.iam.gserviceaccount.com" \
--role="roles/bigquery.resourceViewer"
- INFORMATION_SCHEMA.JOBS_BY_PROJECT
- JOBS_TIMELINE_BY_PROJECT
- Slot usage & reservation data
- Failure data & error messages
- Job wait time & bytes billed
Storage Metadata Access
roles/bigquery.metadataViewer
Read-only metadata only — no access to actual table data.
gcloud projects add-iam-policy-binding PROJECT_ID \
--member="serviceAccount:lighthouse@PROJECT_ID.iam.gserviceaccount.com" \
--role="roles/bigquery.metadataViewer"
- INFORMATION_SCHEMA.TABLE_STORAGE_BY_PROJECT
- Dataset and table metadata
- Stale table detection
- Active vs long-term storage breakdown
Read-only, always → Both IAM roles grant read-only access to operational metadata. Run them once and you're done — new jobs, tables, datasets, and activity are automatically covered. Lighthouse cannot write data, drop tables, create datasets, or access the actual contents of your tables — only operational metadata like job durations, slot consumption, and storage sizes.