Manage data products

Console

Review access requests for a specific data product

1. In the Google Cloud console, go to the Knowledge Catalog Data products page.

   Go to Data products

2. Click the data product for which you want to review access requests.

3. Click the Access request management tab.

4. Select the requester whose request you want to review.

5. Click more_vert Actions and then click Approve or Reject.

6. Click Save.

Review access requests across multiple data products

1. In the Google Cloud console, go to the Knowledge Catalog Governance workflows page.

   Go to Governance workflows

2. Click the Pending Approvals tab.

3. Optional: Filter the list by the specific data product name to isolate its requests.

4. Select the target request and click Approve or Reject.

5. Click Save.

Post-approval behavior

• User requests: Consumers who requested access for their user identity are automatically added as members to the Google Group mapped to the access group.

• Service account requests: Consumers who requested access for a service account are granted permissions to impersonate the data producer service account mapped to the access group.

Once processed, the request status updates automatically and the entry moves to the Approval log tab.

REST

List all pending access requests

To list all access requests that are pending your review within a specific project and location, send a GET request using the custom collection method :listReviewable:

curl -X GET \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
"https://dataplex.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/changeRequests:listReviewable"

Replace the following:

• PROJECT_ID: the ID of your Google Cloud project

• LOCATION: the region where the data product exists (for example, us-central1)

Approve an access request

Data product owners with the dataplex.dataProducts.approve permission can approve a pending request by sending a POST request to the custom method :approve:

curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
"https://dataplex.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/changeRequests/CHANGE_REQUEST_ID:approve"

Replace the following:

• PROJECT_ID: the ID of your Google Cloud project

• LOCATION: the region where the data product exists (for example, us-central1)

• CHANGE_REQUEST_ID: the unique ID of your access request you want to approve

Unlike console-driven approvals, approving a change request using the REST API doesn't automatically modify Google Group memberships or configure service account token impersonation. You must complete these downstream access management steps manually:

• For user identity access requests: Add the data product consumer to the mapped Google Group. For more information, see Add a membership to a Google Group.

• For service account access requests: Grant the Service Account Token Creator (roles/iam.serviceAccountTokenCreator) IAM role to the data product consumer's service account on the resource by running the following command:

  gcloud iam service-accounts add-iam-policy-binding PRODUCER_SERVICE_ACCOUNT \
    --member="serviceAccount:CONSUMER_SERVICE_ACCOUNT" \
    --role="roles/iam.serviceAccountTokenCreator"
  

  Replace the following:

  • PRODUCER_SERVICE_ACCOUNT: the fully qualified email address of the service account mapped to the data product's access group

  • CONSUMER_SERVICE_ACCOUNT: the fully qualified email address of the service account belonging to the consumer requesting access

Reject an access request

Data product owners with the dataplex.dataProducts.approve permission can reject a pending request by sending a POST request to the custom method :reject along with a justification payload:

curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
  "comment": "REJECTION_REASON"
}' \
"https://dataplex.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/changeRequests/CHANGE_REQUEST_ID:reject"

Replace the following:

• PROJECT_ID: the ID of your Google Cloud project

• LOCATION: the region where the data product exists (for example, us-central1)

• CHANGE_REQUEST_ID: the unique ID of your access request you want to reject

Console

1. In the Google Cloud console, go to the Knowledge Catalog Data products page.

   Go to Data products

2. Click the data product that you want to update.

3. Click Edit.

4. Update the Data product name, Data product icon, Description, Data product owner(s) email address, Data product approver(s) email address, and Labels as required.

5. Click Save.

C#

using Google.Cloud.Dataplex.V1;
using Google.LongRunning;
using Google.Protobuf.WellKnownTypes;

public sealed partial class GeneratedDataProductServiceClientSnippets
{
    /// <summary>Snippet for UpdateDataProduct</summary>
    /// <remarks>
    /// This snippet has been automatically generated and should be regarded as a code template only.
    /// It will require modifications to work:
    /// - It may require correct/in-range values for request initialization.
    /// - It may require specifying regional endpoints when creating the service client as shown in
    ///   https://cloud.google.com/dotnet/docs/reference/help/client-configuration#endpoint.
    /// </remarks>
    public void UpdateDataProductRequestObject()
    {
        // Create client
        DataProductServiceClient dataProductServiceClient = DataProductServiceClient.Create();
        // Initialize request argument(s)
        UpdateDataProductRequest request = new UpdateDataProductRequest
        {
            DataProduct = new DataProduct(),
            UpdateMask = new FieldMask(),
            ValidateOnly = false,
        };
        // Make the request
        Operation<DataProduct, OperationMetadata> response = dataProductServiceClient.UpdateDataProduct(request);

        // Poll until the returned long-running operation is complete
        Operation<DataProduct, OperationMetadata> completedResponse = response.PollUntilCompleted();
        // Retrieve the operation result
        DataProduct result = completedResponse.Result;

        // Or get the name of the operation
        string operationName = response.Name;
        // This name can be stored, then the long-running operation retrieved later by name
        Operation<DataProduct, OperationMetadata> retrievedResponse = dataProductServiceClient.PollOnceUpdateDataProduct(operationName);
        // Check if the retrieved long-running operation has completed
        if (retrievedResponse.IsCompleted)
        {
            // If it has completed, then access the result
            DataProduct retrievedResult = retrievedResponse.Result;
        }
    }
}

Go

//go:build examples

package main

import (
	"context"

	dataplex "cloud.google.com/go/dataplex/apiv1"
	dataplexpb "cloud.google.com/go/dataplex/apiv1/dataplexpb"
)

func main() {
	ctx := context.Background()
	// This snippet has been automatically generated and should be regarded as a code template only.
	// It will require modifications to work:
	// - It may require correct/in-range values for request initialization.
	// - It may require specifying regional endpoints when creating the service client as shown in:
	//   https://pkg.go.dev/cloud.google.com/go#hdr-Client_Options
	c, err := dataplex.NewDataProductClient(ctx)
	if err != nil {
		// TODO: Handle error.
	}
	defer c.Close()