# BigQuery extract setup

The extract stage lands Parquet snapshots in a GCS bucket co-located with the source
dataset (`bq extract` requires the bucket to match the dataset's location). The bucket,
its lifecycle/retention, and the read-only loader service account are provisioned as IaC
under `setup/grunt/`, mirroring the TiDB extract's `s3-export-setup`. Everything is read
from the source's `source.yaml` (`gcs` + `retention` blocks) so infra and the engine never
drift.

```bash
# Google provider auth: a short-lived token is enough for apply.
export GOOGLE_OAUTH_ACCESS_TOKEN="$(gcloud auth print-access-token)"
terragrunt --working-dir ingestion/extract/bigquery/setup/grunt/<source> apply
```

This provisions:

- the snapshot bucket (uniform access, public-access-prevention, and lifecycle rules that
  expire snapshots after `retention.gcs_snapshots_days` and manifests/logs after
  `retention.manifests_days`);
- a read-only loader service account (`<source>-gcs-loader-reader`) with `objectViewer` on
  the bucket, and a key.

Wire the key into the **load** source's `secrets.env` as `METADB_GCS_CREDENTIAL` (the value
Databend's `COPY INTO` uses to read the bucket):

```bash
terragrunt --working-dir ingestion/extract/bigquery/setup/grunt/<source> \
    output -raw loader_reader_credential
```

The local `terraform.tfstate` holds the service-account key and is gitignored, the same as
the TiDB setup's IAM access keys.