GA4 via BigQuery
Chord uses a service account in your Google Cloud project to copy your GA4 export out of BigQuery and into your Cloud Storage bucket.
You create the account, grant it four roles, and send Chord the account details and a JSON key.
Before you start, you need an active GA4 to BigQuery link and a landing bucket that Chord can read.
Pick one way to set this up, not both.
Option A uses the Google Cloud console.
Option B runs the same steps with the gcloud CLI.
Both end in the same place. Then go to What to send Chord.
Option A: Google Cloud console
Create the service account
Use the project that holds your analytics_<property_id> dataset.
- In the Google Cloud console, open the Create service account page and select that project.
- Enter a name, for example chord-ga4. Google builds the account ID from it, and you cannot change the ID later.
- Click Create and continue, then Done. You will grant the roles in the next section, so you can skip the role step here.
You need the Create Service Accounts role (roles/iam.serviceAccountCreator) on the project. To grant roles you also need Project IAM Admin (roles/resourcemanager.projectIamAdmin). A new service account can take a minute or more before it is usable.
Grant the roles
Grant each role at the narrowest level Google allows. You will need the service account's email, for example [email protected].
On the project.
BigQuery Job User and BigQuery Read Session User can only be granted on a project, folder or organization, never on a single dataset.
- Open IAM & Admin → IAM and select your project.
- Click Grant access.
- Enter the service account email under New principals.
- Add the roles BigQuery Job User and BigQuery Read Session User, then click Save.
On the dataset.
BigQuery Data Viewer only needs to cover your GA4 dataset.
- In the Google Cloud console, open BigQuery.
- In Explorer, expand your project, click Datasets, and select the analytics_<property_id> dataset.
- Click Sharing → Permissions, then Add principal.
- Enter the service account email.
- In Select a role, choose BigQuery Data Viewer.
- Click Save, then Close.
On the bucket.
Storage Object Admin only needs to cover your landing bucket.
- Open Cloud Storage → Buckets and click the bucket name.
- Open the Permissions tab and click Grant access.
- Enter the service account email under New principals.
- In Select a role, choose Storage Object Admin, then click Save.
Create a JSON key
- Open the Service accounts page and select your project.
- Click the email address of the service account.
- Open the Keys tab.
- Click Add key, then Create new key.
- Select JSON as the key type and click Create.
The key file downloads once and Google cannot show it again.
The JSON key is a secret. Send it to Chord through a secure channel, never by email or Slack. Delete your local copy once Chord confirms the connection works.
Option B: gcloud CLI
Skip this section if you used Option A. It does the same thing from the command line.
Set these values first.
PROJECT_ID=your-project-id
DATASET=analytics_123456789
BUCKET=your-bucket-name
SA=chord-ga4
SA_EMAIL=$SA@$PROJECT_ID.iam.gserviceaccount.comCreate the account.
gcloud iam service-accounts create $SA \
--project=$PROJECT_ID \
--display-name="Chord GA4 replication"Grant the two project-level roles.
gcloud projects add-iam-policy-binding $PROJECT_ID \
--member="serviceAccount:$SA_EMAIL" --role="roles/bigquery.jobUser"
gcloud projects add-iam-policy-binding $PROJECT_ID \
--member="serviceAccount:$SA_EMAIL" --role="roles/bigquery.readSessionUser"Grant Data Viewer on the dataset. Run this in the BigQuery query editor.
GRANT `roles/bigquery.dataViewer`
ON SCHEMA `your-project-id`.analytics_123456789
TO "serviceAccount:[email protected]"Grant Storage Object Admin on the bucket.
gcloud storage buckets add-iam-policy-binding gs://$BUCKET \
--member="serviceAccount:$SA_EMAIL" --role="roles/storage.objectAdmin"Create the key.
gcloud iam service-accounts keys create chord-ga4-key.json \
--iam-account=$SA_EMAILThe key file chord-ga4-key.json is saved in your current folder. Treat it as a secret, as in Option A.
What to send Chord
- Service account email. For example [email protected].
- JSON key. The key file, through a secure channel.
- GCP project ID. The project that holds the dataset.
- Dataset name. Usually analytics_<property_id>.
- Bucket name. The full path, starting with gs://.
There is no setup screen in Hub for this source yet. Chord configures the connection from these values.
Rotating and revoking access
Rotation. Google recommends rotating keys regularly. Create a new key, send it to Chord, wait for Chord to confirm it works, then delete the old key. Google advises disabling a key before deleting it, because a deleted key cannot be restored.
Revoking access. Deleting the key cuts off Chord's access, and replication stops until you send a new one. To delete a key, open the service account, open the Keys tab, and click Delete next to the key. Deleting a key does not cancel short-lived credentials already issued from it. To cut those off as well, disable or delete the service account.
Troubleshooting
Why can't I create the JSON key?
Your organization may enforce the iam.disableServiceAccountKeyCreation policy. Google turns it on by default for organizations created on or after May 3, 2024. An organization policy administrator can exempt your project. They tag the project not_enforced and update the policy so it applies to everything except tagged resources. This needs the Organization Policy Administrator, Organization Viewer and Tag Administrator roles. See Google's guide.
Why does Chord report a permission error?
Check that all four roles are in place. The two BigQuery roles must be on the project, Data Viewer on the dataset, and Storage Object Admin on the bucket.
Need help? Contact your Chord representative or email [email protected].