When designing a data mesh on Google Cloud using Dataplex to manage data in BigQuery and Cloud Storage, it is essential to simplify data asset permissions while ensuring that each user group has the appropriate access levels. Here's why option A is the best choice:
Data Engineer Group:
Data engineers require full access to the data lake to manage and operate data assets comprehensively. Granting the dataplex.dataOwner role to the data engineer group on the customer data lake ensures they have the necessary permissions to create, modify, and delete data assets within the lake.
Analytic User Group:
Analytic users need access to curated data but do not require full control over all data assets. Granting the dataplex.dataReader role to the analytic user group on the customer curated zone provides read-only access to the curated data, enabling them to analyze the data without the ability to modify or delete it.
Steps to Implement:
Grant Data Engineer Permissions:
Assign the dataplex.dataOwner role to the data engineer group on the customer data lake to ensure full access and management capabilities.
Grant Analytic User Permissions:
Assign the dataplex.dataReader role to the analytic user group on the customer curated zone to provide read-only access to curated data.
Reference:
Dataplex IAM Roles and Permissions
Managing Access in Dataplex