What Is a Service Account and How to Use It in Looker Studio?

When there are changes in the team, it is common to have problems accessing data in the report. This is especially true for Google BigQuery sources, which are particularly difficult to work with when a report has many tables. When you change users, you have to perform the time-consuming task of reconnecting each table. However, if the connection was made through a service account, it becomes a different story.

A service account is a special type of account used to perform actions on behalf of an application or virtual machine rather than on behalf of a user. It has a unique email address and allows applications to make authorized API calls and access resources, for example, to build analytics.

In this article, I will explain what a service account is, how to create one, and how to transfer your data sources to it in Looker Studio reports.

Why do you need a service account?

1. Security. A service account has no personal information associated with it, and the account is accessed using a token rather than a user login and password.
2. Automation. The account regularly collects data, processes it, and updates resources. In other words, there is no need for constant monitoring by a specialist.

3. Audit and control. Actions performed using service accounts are easily tracked and can be restricted at any time.

How do you create a Looker Studio service account?

Looker Studio is an easy-to-use and popular tool for creating visual reports and graphs. It takes information from various sources, such as Google Analytics 4, Google Ads, or BigQuery, and instantly creates a report.

One advantage of a service account for Looker Studio is that it does not depend on personal user data. Without a service account, the connection between Looker Studio and other services is made through the user account. Consequently, if the specialist who created the report leaves the company, others may have problems accessing the data. This is especially true for Google BigQuery sources, where each table must be reconfigured for new users. 

A report configured through a service account will work regardless of who configured it or who uses it.

Creating a service account in Google Cloud

To create a Google Cloud service account, follow these steps:

1. Obtain a Looker Studio Service Agent. This special service account from Google enables interactions between Looker Studio and other Google Cloud services. It allows Looker Studio to securely access data in other Google Cloud services, such as BigQuery and Google Sheets, and automatically authenticates Looker Studio when data is requested.

To obtain the Service Agent:

• Go to the Looker Studio Service Agent Help page using your business account.
• Copy the Service Agent email address listed on that page.

2. Next, create a service account:

• Go to the Google Cloud Console service account creation page.
• Select a project.
• Enter the name of the service account that will appear in Cloud Console.
• Enter a description (optional).

Click Create and continue.

• Grant this service account access to the project and select the BigQuery Job User role.
• Click Continue.

• Click Done to save the service account.

This opens a page with a list of all service accounts for your project.

How do you grant access to a service account?

To grant access to a Looker Studio service account, follow the steps below:

1. On the Service Accounts list page, click on the Looker Studio service account you just created.
2. Click Manage Access at the top.

3. In a new window on the right, click Add principal.

4. Paste the Looker Studio service agent email address you copied earlier into the New principals field.  
5. Select the role that gives the service agent the access level, for example, Service Account Token Creator.
6. Click Save.

Next, grant the service account access to BigQuery data:

1. Go to the Cloud Console Service Accounts List and select your project.
2. Copy the email address of the Looker Studio service account.

3. In BigQuery, open the required project and select the dataset.
4. Then select More Options – Sharing – Manage Permissions.

5. In a new window on the right, click Add Principal.

6. Paste the Looker Studio service account email that you copied earlier into the Looker Studio Service Agent Help.
7. Select the BigQuery Data Viewer role.
8. Click Save.

How do you transfer data sources in Looker Studio reports to a service account?

1. Open the desired report in Looker Studio.
2. Switch to edit mode.

3. Select Resource – Manage added data sources.

4. Select the data source you want to transfer to the service account and click Edit.

5. Click Credentials.

6. Select Service Account Credentials. Enter the service account email address. Click Update.

If the change is successful, you will see the following.

Risks of connecting Looker Studio and Google BigQuery

While service accounts are essential for secure and automated access to data, it’s important to consider the potential risks. The main issue is how Looker Studio and Google BigQuery interact.

1. Repeated data queries increase costs.

When Looker Studio is connected to Google BigQuery to create reports, a new SQL query is executed each time you apply a filter, change a time period, or visualize.

BigQuery uses a pay-as-you-go data sampling model, which means that you pay for the amount of data BigQuery analyzes and processes. So, if a report in Looker Studio is complex or contains many filters, you will need many queries, and the costs will increase.

2. Limited caching capability.

Looker Studio has limited data caching abilities. As it does not store data locally, it has to make a direct request to the source each time.

When should I use Power BI or Tableau?

Tools such as Power BI and Tableau are similar to Looker Studio. The main difference is that they store data in memory or on a local server, therefore reducing the load on cloud resources and minimizing costs. 

These tools are useful for the following scenarios:

1. Large-scale data analysis. If you work with frequently updated reports, using tools that cache data is better, as they won’t have to make constant requests to the cloud.
2. Intensive report usage. When using reports with many filters and visualizations, it is more budget-friendly to avoid repeated calls to BigQuery, This can be achieved by working with cached data, which will reduce the cost of cloud resources.
3. Infrequent data updates. If data in BigQuery is not updated very often and there is no need to query every time a report filter changes, Power BI or Tableau will be more cost-effective.

However, there are situations where using Looker Studio in combination with Google BigQuery can be justified:

1. To create simple reports with small amounts of data, where frequent queries won’t incur high costs.
2. To quickly set up visualizations for teams that are already working using Google Cloud and are looking for an easy way to visualize data without using third-party services.

Conclusions

1. A service account, which is created on Google Cloud, is a special type of account that is used to perform actions on behalf of an application or virtual machine rather than a user.
2. There are several benefits to using service accounts:

• Increased security
• Process automation
• Granular access control
• Ability to audit actions

3. Looker Studio uses service accounts to securely access data on Google Cloud.
4. The process of migrating Looker Studio reports to a service account consists of two main steps:

• Granting access to the dataset or table.
• Changing the credentials in the report data source settings.

5. Properly configured service accounts can streamline workflows and ensure more efficient use of Looker Studio in a corporate environment.
   When BigQuery tables are authorized in Looker Studio using a service account, report data remains protected and available even if the team members or contractors change.
6. While service accounts have many benefits, they currently only work with BigQuery sources.