BigQuery datasets should require corporate-domain access and prohibit access by gmail.com addresses
The powerpipe check restrict_gmail_bigquery_dataset enforces a corporate domain by banning gmail.com addresses access to BigQuery datasets. A dataset is in alarm if its access list has a userByEmail like '%gmail.com'.
What this control checks
BigQuery datasets require corporate-domain access and prohibit gmail.com addresses
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.restrict_gmail_bigquery_dataset.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-01 (The organizational mission is understood and informs cybersecurity risk management.).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.OC-01: The organizational mission is understood and informs cybersecurity risk management.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
restrict_gmail_bigquery_dataset - Powerpipe Control:
gcp_compliance.control.restrict_gmail_bigquery_dataset
Last reviewed: 2026-10-10