Support configuration of a default project-level Cloud KMS key for BigQuery

[rorynickolls-skyral]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Description

When BigQuery uses a customer-managed Cloud KMS key for encryption, the key needs to be explicitly specified at query-time.

We currently use the BigQuery datasource for Grafana, and that has no option to specify a key.

Instead, I've had to manually run a DDL statement which appears to be the only way set the project default key (Google docs)

There doesn't appear to be a way to configure BigQuery at the project level like this through the Terraform provider but it'd be great to do so and avoid this manual step.

New or Affected Resource(s)

• google_bigquery_*

Potential Terraform Configuration

resource "google_bigquery_options" "eu_bigquery_options" {
  project = <project>
  region = "eu"
  
  default_kms_key_name = "my_kms_key"
}

References

No response

b/377316940

[rileykarson]

I think this would be a new resource? We can fix the tags if not.

[wj-chen]

Yes the only way to set a project-level default key is by running a DDL statement today. You may explore using the google_bigquery_job Terraform resource to run that statement as a query job in your setup. Please let us know if that works or doesn't work for your use case.

[wj-chen]

Requesting the current terraform-team-oncall @shuyama1 to close this issue as a workaround has been communicated over a month ago and we won't be pursuing adding that functionality to an existing or new Terraform resource at this time.

[wj-chen]

Requesting the current terraform-team-oncall @shuyama1 to close this issue as a workaround has been communicated over a month ago and we won't be pursuing adding that functionality to an existing or new Terraform resource at this time.

@shuyama1 Could you help close this issue? Thanks.