1711562 - Add the `moz-fx-data-experiments` project to Looker

Status: RESOLVED FIXED

(Data Platform and Tools Graveyard :: Operations, task, P3)

Description

[Anna Scholtz [:ascholtz]]

We are planning to move some experimentation related dashboards to Looker. For this, access to tables in moz-fx-data-experiments is required.

Comment 1

[Wesley Dawson [:whd]]

Adding workgroup:dataops-managed/looker to https://github.com/mozilla-services/data-sandbox-terraform/blob/main/projects/experiments-analysis/project/main.tf#L59 is probably the correct way to add this access.

Comment 2

[Jeff Klukas [:klukas] (UTC-4)]

(In reply to Wesley Dawson [:whd] from comment #1)

Adding workgroup:dataops-managed/looker to https://github.com/mozilla-services/data-sandbox-terraform/blob/main/projects/experiments-analysis/project/main.tf#L59 is probably the correct way to add this access.

ascholtz - Is this still needed? Do you want to pursue a PR for this?

Comment 3

[Anna Scholtz [:ascholtz]]

Yes, still needed. I can take this.

Comment 4

[Anna Scholtz [:ascholtz]]

Attachment: GitHub Pull Request

Comment 5

[Anna Scholtz [:ascholtz]]

I've tried creating a view for a table in moz-fx-data-experiments in Looker after adding the workgroup but I am getting a permissions denied error: User does not have permission to query table moz-fx-data-experiments:monitoring.logs. Also the project doesn't show up as "Database" under the telemetry connection. Is there something that is missing here? Does this project need to be added by a Looker admin?

Comment 6

[Wesley Dawson [:whd]]

It looks like the PR was merged but not applied. The apply process is not automated but is described in the docs for the repo. I ran the following to apply it:

$ cd data-sandbox-terraform/projects/experiments-analysis/project
$ terraform apply
module.project.random_id.project: Refreshing state... [id=OpQ]
module.project.google_project.project: Refreshing state... [id=projects/moz-fx-data-experiments]
google_service_account.partybal: Refreshing state... [id=projects/moz-fx-data-experiments/serviceAccounts/[e-mail]]
google_storage_bucket.mozanalysis: Refreshing state... [id=mozanalysis]
google_project_service.storage: Refreshing state... [id=moz-fx-data-experiments/storage.googleapis.com]
google_project_iam_binding.project_object_viewer: Refreshing state... [id=moz-fx-data-experiments/roles/storage.objectViewer]
google_project_iam_member.bigquery_dataviewer["serviceAccount:[e-mail]"]: Refreshing state... [id=moz-fx-data-experiments/roles/bigquery.dataViewer/serviceaccount:[e-mail]]
google_project_iam_member.bigquery_dataviewer["serviceAccount:[e-mail]"]: Refreshing state... [id=moz-fx-data-experiments/roles/bigquery.dataViewer/serviceaccount:[e-mail]]

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # google_project_iam_member.bigquery_dataviewer["serviceAccount:[e-mail]"] will be created
  + resource "google_project_iam_member" "bigquery_dataviewer" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:[e-mail]"
      + project = "moz-fx-data-experiments"
      + role    = "roles/bigquery.dataViewer"
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

google_project_iam_member.bigquery_dataviewer["serviceAccount:[e-mail]"]: Creating...
google_project_iam_member.bigquery_dataviewer["serviceAccount:[e-mail]"]: Creation complete after 9s [id=moz-fx-data-experiments/roles/bigquery.dataViewer/serviceaccount:[e-mail]]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Comment 7

[Anna Scholtz [:ascholtz]]

Thanks, that worked! I didn't realize this process wasn't automated, good to know.