title: Restrict Bigquery export to Cloud Storage
body: <p>I am currently exploring the GCP BigQuery IAM &amp; Access Control. </p>
  
  <p>The list of users can be managed through groups. Here's an example: </p>
  
  <pre><code>Group A - Has access to BigQuery (BigQuery User Role, Viewer Access to specific datasets)
  Group B - Has bucket-owner access to Cloud Storage
  </code></pre>
  
  <p>Common users who are in both groups have the ability to export data from BigQuery to Cloud Storage. So, what is the best practice to deny exporting certain BigQuery tables or data that is larger than a certain number of rows, so transactional data exports are restricted?</p>