Grant Billing Access in Databricks, Google BigQuery, and Snowflakes Best Practices

Databricks

Usage & Billing Access

Databricks system tables are account-scoped. A single Databricks service principal covers all workspaces within the account.

Prerequisites

  1. Enable system tables: system.billing.usage and system.query.history are disabled by default. Enable them in the Databricks Account Console under Settings and System tables before any grants take effect.

  2. Account-level Service Principal: The service principal must be created in the Databricks Account Console (not just the workspace) and then assigned to the target workspace.

Grants

Unity Catalog requires USE CATALOG permissions before USE SCHEMA privileges can be applied. All three hierarchical levels must be explicitly granted.

Copy 
-- Catalog access (required before schema grants will work)
GRANT USE CATALOG ON CATALOG system TO mosaic_sentinel_svc;

-- Billing tables
GRANT USE SCHEMA ON SCHEMA system.billing TO mosaic_sentinel_svc;
GRANT SELECT ON TABLE system.billing.usage TO mosaic_sentinel_svc;

-- Query history tables
GRANT USE SCHEMA ON SCHEMA system.query TO mosaic_sentinel_svc;
GRANT SELECT ON TABLE system.query.history TO mosaic_sentinel_svc;

system.query.history is a Public Preview feature and must be enabled per workspace in addition to the account-level system table toggle.

Snowflake

Usage and Billing Access

Snowflake metadata views are account-scoped. A single service user can be used to cover all databases and warehouses within the account.

Prerequisites

  1. Edition Requirement: Enterprise Edition or higher is required. The QUERY_ATTRIBUTION_HISTORY view is only available on Enterprise and above. Verify the Snowflake edition before onboarding.

  2. Role Setup: A dedicated custom role (for example, sentinel_cost_role) must exist and be assigned to your Snowflake service user (mosaic_sentinel_svc) before proceeding with grants.

Grants

Snowflake-managed database roles allow for the least-privilege access to specific subsets of the ACCOUNT_USAGE schema, offering a more narrow blast radius than granting full database-level privileges.

Copy 
-- Grant fine-grained database roles (Snowflake-managed, least-privilege)
-- USAGE_VIEWER: Covers QUERY_ATTRIBUTION_HISTORY and billing views
GRANT DATABASE ROLE SNOWFLAKE.USAGE_VIEWER TO ROLE sentinel_cost_role;

-- GOVERNANCE_VIEWER: Covers QUERY_HISTORY and governance views
GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE sentinel_cost_role;

-- Assign the custom role to the service user
GRANT ROLE sentinel_cost_role TO USER mosaic_sentinel_svc;

-- Grant warehouse usage for query execution
GRANT USAGE ON WAREHOUSE <sentinel_warehouse> TO ROLE sentinel_cost_role;

The Snowflake-managed database roles are highly restricted. They are significantly safer than granting IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE, which exposes all account views. This targeted approach is preferred for new onboardings.

Google BigQuery Service Account Set Up

To track BigQuery usage and costs across multiple Google Cloud projects, a dedicated Service Account must be created and granted specific roles.

If you want to track billing and query usage across multiple projects, you must grant this service account the exact same privileges in every project you want to track. A service account only has access to the specific project where the roles are assigned.

  1. Create a service account. You must create the identity that the software will use to authenticate with Google Cloud:

    You only need to create a service account on your primary project.

    1. Log in to the Google Cloud Console.

    2. Click the Navigation menu in the top left corner.

    3. Go to IAM & Admin > Service Accounts.

    4. Click Create Service Account.

    5. Type a descriptive Service account name. For example, bi-billing-tracker.

    6. Click Create and continue.

  2. Grant the required privileges in the primary project. You must assign the specific IAM roles required to execute queries and read the INFORMATION_SCHEMA.JOBS system view:

    1. In Grant this service account access to project, click Select a role.

    2. Search and select BigQuery Users (roles/bigquery.user). This role allows the account to execute queries.

    3. Click Add another role.

    4. Search and select BigQuery Resource Viewer (roles/bigquery.resourceViewer). This role grants the bigquery.jobs.listAll permission that Sentinel needs to view billing data across the project, not just on its own.

    5. Click Done.

  3. Assign privileges across all other projects. If you have multiple projects, you must grant the new service account access to those projects, as well:

    1. Expand the project drop-down at the top of the console and choose a new project.

    2. Go to IAM & Admin > IAM.

    3. Click Grant access at the top of the page.

    4. In New principals, paste the exact email address used in the service account you created.

    5. Assign the same two roles you assigned in step 2, BigQuery User and BigQuery Resource Viewer.

    6. Click Save.

    7. Repeat step 3 for all remaining projects you want to track.

  4. Generate the JSON key. This is the authentication file that you external software will use to connect.

    1. In the primary project that you originally created the account, go to IAM & Admin > Service Accounts.

    2. Click the service account email address.

    3. Click the Keys tab.

    4. Click Add key > Create new key.

    5. Select JSON and click Create.

    6. The key file downloads to your machine. Securely provide this file to the user configuring Sentinel.

Related Topics

To setup Databricks to enable cost intelligence and usage analytics without requiring individual user credentials, see Connect to Databricks Using Service Principal.