Secure Lakehouse Data

ARC129 — Secure Lakehouse Data: Challenge Lab

Estimated time: 10 minutes

# Secure BigLake Data Challenge Lab Follow the execution sequence below exactly as shown to successfully complete all tasks. ## 🚀 Step-by-Step Raw Execution (Recommended) ### 🔹 Step 1 — Execute Command (1 of 2) 1. Open **Google Cloud Shell**. 2. Copy and paste **Command (1 of 2)** into the terminal. 3. Press **Enter**. The script will: - ✅ Display the **Orbit of Ops** branding. - ✅ Pause and request **User 2's Email Address**. Copy **User 2's Email** directly from the **left panel** of

GREEN='\e[1;32m'
CYAN='\e[1;36m'
YELLOW='\e[1;33m'
MAGENTA='\e[1;35m'
RED='\e[1;31m'
RESET='\e[0m'
BOLD='\e[1m'

clear
echo -e "${CYAN}${BOLD}"
cat << "EOF"
  ____       _     _ _            __    ___            
 / __ \     | |   (_) |          / _|  / _ \           
| |  | |_ __| |__  _| |_   ___  | |_  | | | |_ __  ___ 
| |  | | '__| '_ \| | __| / _ \ |  _| | | | | '_ \/ __|
| |__| | |  | |_) | | |_ | (_) || |   | |_| | |_) \__ \
 \____/|_|  |_.__/|_|\__| \___/ |_|    \___/| .__/|___/
                                            | |        
                                            |_|        
EOF
echo -e "${RESET}"
echo -e "${MAGENTA}${BOLD}>>> ORBIT OF OPS: ARC129 TERMINAL AUTOMATION INITIALIZED <<<${RESET}\n"

export PROJECT_ID=$(gcloud config get-value project 2>/dev/null)
echo -e "${YELLOW}${BOLD}[*] Project ID: ${PROJECT_ID}${RESET}\n"

echo -e "${CYAN}${BOLD}⚠️  ATTENTION: USER 2 CREDENTIALS REQUIRED ⚠️${RESET}"
read -p "Enter User 2 Email (e.g., [email protected]): " USER_2
echo ""

# Save state securely for Command 2
cat > ~/.orbit_env <<ENV_EOF
export PROJECT_ID="${PROJECT_ID}"
export USER_2="${USER_2}"
ENV_EOF

echo -e "${GREEN}${BOLD}>>> VARIABLES LOCKED! Proceed to Command (2 of 2). <<<${RESET}"

GREEN='\e[1;32m'
CYAN='\e[1;36m'
YELLOW='\e[1;33m'
BLUE='\e[1;34m'
MAGENTA='\e[1;35m'
RESET='\e[0m'
BOLD='\e[1m'

source ~/.orbit_env

echo -e "${CYAN}${BOLD}[Orbit of Ops] Step 1: Creating BigQuery Dataset & Connection...${RESET}"
bq mk --location=US online_shop 2>/dev/null || true
bq mk --connection --location=US --project_id=$PROJECT_ID --connection_type=CLOUD_RESOURCE user_data_connection 2>/dev/null || true

echo -e "${YELLOW}${BOLD}[Orbit of Ops] Step 2: Granting BigLake Service Account Permissions...${RESET}"
export SERVICE_ACCOUNT=$(bq show --format=json --connection $PROJECT_ID.US.user_data_connection | jq -r '.cloudResource.serviceAccountId')
gcloud projects add-iam-policy-binding $PROJECT_ID --member=serviceAccount:$SERVICE_ACCOUNT --role=roles/storage.objectViewer --quiet

echo -e "${MAGENTA}${BOLD}[Orbit of Ops] Step 3: Creating BigLake Table Definition...${RESET}"
bq mkdef --autodetect --connection_id=$PROJECT_ID.US.user_data_connection --source_format=CSV "gs://$PROJECT_ID-bucket/user-online-sessions.csv" > /tmp/tabledef.json
bq mk --external_table_definition=/tmp/tabledef.json --project_id=$PROJECT_ID online_shop.user_online_sessions 2>/dev/null || true

echo -e "${YELLOW}${BOLD}[Orbit of Ops] Step 4: Removing User 2 IAM Policy Binding...${RESET}"
gcloud projects remove-iam-policy-binding ${PROJECT_ID} --member="user:$USER_2" --role="roles/storage.objectViewer" --quiet

rm /tmp/tabledef.json ~/.orbit_env 2>/dev/null

echo -e "\n${GREEN}${BOLD}>>> SCRIPT COMPLETE! Please follow the UI steps below to finish Task 2. <<<${RESET}"