Create cross-cloud connections

Cross-cloud connections are BigQuery connections that bring data from Amazon Web Services (AWS), Microsoft Azure, and Salesforce Data 360 into BigQuery for querying. These connections are an alternative to standard BigQuery connections that use BigQuery Omni, where BigQuery deploys lightweight compute workers to remote regions to make data in other clouds available for querying without any data movement.

Workloads can benefit from cross-cloud connections versus standard connections for the following reasons:

• Feature consistency. By bringing your data from other clouds into BigQuery, you gain direct access to BigQuery AI capabilities, Gemini Enterprise Agent Platform, materialized views, user-defined functions, and other features that aren't available through standard connections.
• Cost efficiency. Workloads that use cross-cloud connections consume standard slot reservations and commitments, eliminating the need to manage separate compute capacities.

If your workload involves Apache Iceberg catalogs or you need query support across engines other than BigQuery, consider using cross-cloud Lakehouse for Apache Iceberg instead.

Before you begin

Grant Identity and Access Management and third-party roles that give users the necessary permissions to perform each task in this document.

Required BigQuery roles

To get the permissions that you need to create a cross-cloud connection, ask your administrator to grant you the BigQuery Admin (roles/bigquery.admin) IAM role on the project. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Required third-party roles

To get the permissions that you need to create a cross-cloud connection, ensure that you have the following third-party roles:

• For AWS: a role that lets you create IAM policies and roles in your AWS account.
• For Azure: a role that lets you manage App Registrations in Microsoft Entra ID (Azure AD) and assign roles, such as Storage Blob Data Reader, on the target Azure account.

Create AWS cross-cloud connections

To create an AWS cross-cloud connection, do the following:

1. Create an AWS IAM policy for BigQuery as you would for standard BigQuery connections.
2. Create an AWS IAM role for BigQuery as you would for standard BigQuery connections.

3. To create a connection resource, use the bq mk --connection command:

   bq mk --connection \
       --connection_type='AWS' \
       --location=LOCATION \
       --project_id=PROJECT_ID \
       --properties='{"accessRole":{"iamRoleId":"arn:aws:iam::AWS_ACCOUNT_ID:role/ROLE_NAME"}}' \
       CONNECTION_ID

   Replace the following:

   • LOCATION: a standard BigQuery location, not a BigQuery Omni location. For guidance on selecting a region, see Region recommendations.
   • PROJECT_ID: the ID of your Google Cloud project.
   • AWS_ACCOUNT_ID: the ID of the AWS IAM user from the previous step.
   • ROLE_NAME: the AWS role policy name that you chose.
   • CONNECTION_ID: an ID to give to this connection resource.

4. To note the service account information, use the bq show command:

   bq show --connection \
       --location=LOCATION \
       PROJECT_ID.LOCATION.CONNECTION_ID

5. Add a trust policy to the AWS role using the service account information, as you would for standard BigQuery connections.

With your established AWS cross-cloud connection, you can now create tables and datasets to query your remote data.

AWS examples

The following example creates an external table to query Parquet files directly from an Amazon Simple Storage Service (Amazon S3) bucket with a cross-cloud connection:

CREATE SCHEMA `my-project.aws_raw_data`
  OPTIONS (
    location = 'us-east4');

CREATE EXTERNAL TABLE `my-project.aws_raw_data.sales_parquet`
WITH CONNECTION `us-east4.my-aws-connection`
  OPTIONS (
    format = 'PARQUET',
    uris = ['s3://my-data-bucket/sales/year=2025/*']);

The following example federates an entire database into BigQuery using AWS Glue with a cross-cloud connection:

CREATE EXTERNAL SCHEMA `my-project.aws_glue_data`
WITH CONNECTION `us-east4.my-aws-connection`
  OPTIONS (
    location = 'us-east4',
    external_source = 'aws-glue://arn:aws:glue:us-east-4:123456789:database/test_database');

For more information on AWS Glue federation, see Create and manage AWS Glue federated datasets.

Create Azure cross-cloud connections

To create an Azure cross-cloud connection, do the following:

1. Create an application in your Azure tenant as you would for standard BigQuery connections, and take note of the Application (client) and Directory (tenant) IDs.
2. Assign a role to the Azure application as you would for standard BigQuery connections.

3. To create a connection resource, use the bq mk --connection command:

   bq mk --connection \
       --connection_type='Azure' \
       --tenant_id=TENANT_ID \
       --location=LOCATION \
       --federated_azure=true \
       --federated_app_client_id=APP_ID \
       --project_id=PROJECT_ID \
       CONNECTION_ID

   Replace the following:

   • TENANT_ID: the tenant ID of the Azure directory that contains the Azure account.
   • LOCATION: a standard BigQuery location, not a BigQuery Omni location. For guidance on selecting a region, see Region recommendations.
   • APP_ID: the Azure Application (client) ID.
   • PROJECT_ID: the ID of your Google Cloud project.
   • CONNECTION_ID: an ID to give to this connection resource.

4. To note the service account information, use the bq show command:

   bq show --connection \
       --location=LOCATION \
       PROJECT_ID.LOCATION.CONNECTION_ID

5. Add a federated credential using the service account information, as you would for standard BigQuery connections.

With your established Azure cross-cloud connection, you can now create tables and datasets to query your remote data.

Azure examples

The following example creates an external table to query Parquet files directly from an Azure Blob Storage container with a cross-cloud connection:

CREATE SCHEMA `my-project.azure_raw_data`
  OPTIONS (
    location = 'us-east4');

CREATE EXTERNAL TABLE `my-project.azure_raw_data.sales_parquet`
WITH CONNECTION `us-east4.my-azure-connection`
  OPTIONS (
    format = 'PARQUET',
    uris = ['azure://mystorageaccount.blob.core.windows.net/mycontainer/sales/year=2025/*']);

The following example creates an external table to query raw CSV exports from a Blob Storage container with a cross-cloud connection:

CREATE EXTERNAL TABLE `my-project.azure_raw_data.daily_logs_csv`
WITH CONNECTION `us-east4.my-azure-connection`
  OPTIONS (
    format = 'CSV',
    skip_leading_rows = 1,
    uris = ['azure://mystorageaccount.blob.core.windows.net/mycontainer/logs/*.csv']);

Create Data 360 cross-cloud connections

To create a Data 360 cross-cloud connection, follow the steps to link a Data 360 dataset to BigQuery, except instead of creating the linked dataset in a BigQuery Omni location, create it in a standard BigQuery location. For guidance on selecting a region, see Region recommendations.

After you update your queries to use the new datasets, you can delete any legacy linked datasets and BigQuery Omni materialized views.

Region recommendations

When you select a standard BigQuery region for your cross-cloud connection, choose the region that is physically closest to your data for optimal cost and performance efficiency.

The following table lists AWS regions and the best corresponding BigQuery regions:

The following table lists Azure regions and the best corresponding BigQuery regions:

What's next

• Learn about BigQuery analytics.