BigQuery: Access Denied: Project my-project: User does not have bigquery.jobs.create permission in project my-project
The principal can read data but is not allowed to run query jobs in the project used for billing.
Access Denied: Project: User does not have bigquery.jobs.create permission in projectUser does not have bigquery.jobs.create permissionAccess Denied: Table: User does not have permission to query tableAccess Denied: Dataset: Permission bigquery.datasets.get deniedBigQuery: Access Denied Meaning
Query jobs run in a project (the billing/job project), separate from the data project. Grant roles/bigquery.jobUser on the job project, plus roles/bigquery.dataViewer on the datasets. Set the correct project in your client (client = bigquery.Client(project=...)).
Common causes
- Missing bigquery.jobUser role
- Client using the data project as job project without rights
- Service account lacking dataViewer on the dataset
- Wrong default project in gcloud/bq
- VPC Service Controls blocking
⚡ Quick fix
- Grant
roles/bigquery.jobUserin the job project - Grant
roles/bigquery.dataVieweron the dataset - Specify
--project_idfor bq or the client
Detailed fix by platform
bq
gcloud projects add-iam-policy-binding PROJECT --member=user:you@example.com --role=roles/bigquery.jobUser
How to diagnose
- Job project — Which one?
- Roles — jobUser and dataViewer?
- Client — Project set?
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
- 403: does not have storage.objects.get access Cloud Storage: 403 Forbidden — user@example.com does not have storage.objects.get access to the Google Cloud Storage object
- 409: The resource already exists Compute Engine: ERROR: (gcloud.compute.instances.create) Could not fetch resource: The resource 'projects/p/zones/z/instances/vm-1' already exists
- 502 Bad Gateway: failed_to_connect_to_backend Google Cloud Load Balancing: 502 Bad Gateway — jsonPayload.statusDetails: failed_to_connect_to_backend / backend_connection_closed_before_data_sent_to_client
Most viewed in Google Cloud / Firebase
- Missing or insufficient permissions Firestore: FirebaseError: [code=permission-denied]: Missing or insufficient permissions
- Container failed to start Cloud Run: The user-provided container failed to start and listen on the port defined provided by the PORT=8080 environment variable
- Could not load the default credentials Google Cloud: Error: Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started
Other ways to find it
Where this error sits
Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Report a correction or suggest an improvement
Last updated 4 Nov 2026