> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect to BigLake using a service-account document

> Use this Google identity method for one BigLake catalog connection.

How-to guideApplies to: Unified engine deployments

Use this Google identity method for one BigLake catalog connection.

## Before you start

Store the complete supported service-account JSON document in
recipe\_google\_document using the [secret form](https://docs.e6data.com/transformation/learn/secrets.md).
Escape SQL string content correctly if creating the secret with SQL.

Use an existing catalog with at least one readable Iceberg table. The engine and
workers must reach the catalog and its table storage. Have the remote identity
and permissions ready before creating the Unified registration. Replace the
namespace and table with one you know has data. The service must return usable
temporary storage credentials, or the table location must already have
configured storage access in Unified. Requesting delegation alone does not grant
access.

## Values to collect

* Identity-specific values below; BigLake URI, warehouse, billing project,
  namespace, and table.

## Run the SQL

Replace every `<placeholder>` before running. Use unused names for the resources
below. Run the statements in order in Workbench.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE CREDENTIAL recipe_gcp_service_account_auth USING gcp
OPTIONS (
  'authentication' = 'service_account',
  'scopes' = 'https://www.googleapis.com/auth/cloud-platform'
)
SECRETS ('credential' = 'recipe_google_document');

CREATE CATALOG recipe_gcp_service_account USING `iceberg-rest`
OPTIONS (
  'catalog.type' = 'biglake',
  'uri' = '<biglake-rest-uri>',
  'warehouse' = '<warehouse>',
  'auth.type' = 'bearer',
  'header.x-goog-user-project' = '<billing-project-id>',
  'scope' = 'https://www.googleapis.com/auth/cloud-platform',
  'header.x-iceberg-access-delegation' = 'vended-credentials'
)
CREDENTIALS ('auth' = 'recipe_gcp_service_account_auth');

SELECT *
FROM recipe_gcp_service_account.`<namespace>`.`<table>`
LIMIT 5;
```

## Check the result

The SELECT should return up to five rows from the chosen table. Use a nonempty
table for this check. This verifies both metadata and table-file access;
creating the registration alone does not verify either.

## Clean up

This removes only the Unified registrations. It leaves the remote catalog and
its tables in place.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP CATALOG recipe_gcp_service_account;
DROP CREDENTIAL recipe_gcp_service_account_auth;
```

Drop recipe\_google\_document only if you created it for this recipe and no other
consumer uses it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.