Google Cloud Compliance ControlsGoogle Cloud BigQuery
BigQuery datasets should require corporate-domain access and prohibit access by gmail.com addresses
The powerpipe check restrict_gmail_bigquery_dataset enforces a corporate domain by banning gmail.com addresses access to BigQuery datasets. A dataset is in alarm if its access list has a userByEmail like '%gmail.com'.
What this control checks
BigQuery datasets require corporate-domain access and prohibit gmail.com addresses
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.OC-01: The organizational mission is understood and informs cybersecurity risk management.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
restrict_gmail_bigquery_dataset - Powerpipe Control:
gcp_compliance.control.restrict_gmail_bigquery_dataset
Last reviewed: 2026-10-10