skills.rest
pbc-os
pbc-osCOMMUNITY
Explore all skills by this author →
GitHub

data-lake-starter

Deploy a secure, empty BigQuery data lake in a GCP project.

10|1|Updated Feb 5, 2026
Search Tags:#bigquery#audit-logging#data-lake#cloud-security#workload-identity#authorized-views
One-click install
npx skills add https://github.com/pbc-os/smb-starter-kit --skill data-lake-starter
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: data-lake-starter
Source: https://github.com/pbc-os/smb-starter-kit/tree/main/skills/tier-1-foundation/data-lake-starter
Command: npx skills add https://github.com/pbc-os/smb-starter-kit --skill data-lake-starter

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Stand up a secure, empty BigQuery data lake in your own GCP project, with layered datasets, least-privilege service accounts, Workload Identity (no downloadable keys), read-only authorized views, audit logging, and a budget alert. You connect your own data sources afterward — on purpose.

Core Features & Use Cases

  • Layered datasets: raw, clean, marts, archive, with a one-way data flow to ensure raw data stays isolated.
  • Three least-privilege service accounts: lake-ingest, lake-transform, lake-agent, each with scoped permissions to write, transform, and read as designed.
  • Workload Identity Federation enabling keyless CI/CD so no secrets are downloaded.
  • Authorized views provide read-only access to marts via views that query raw/clean on the agent's behalf.
  • Audit logging and a billing budget guardrail to monitor activity and costs.
  • Secrets Manager integration planned as part of the hardening standard.
  • Terraform-based Path B for reproducible deployment, if desired.

Quick Start

Ask your agent to run the data-lake-starter skill to build the lake in your project.

Frequently Asked Questions about data-lake-starter

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up a secure BigQuery data lake with least-privilege service accounts?▼

A secure BigQuery data lake uses least-privilege service accounts to isolate reading, writing, and transforming data across layered datasets. This Skill deploys three dedicated identities to enforce strict boundaries between raw, clean, and marts layers.

Can I use Workload Identity Federation for keyless BigQuery deployments?▼

Yes, Workload Identity Federation enables keyless CI/CD for BigQuery deployments. This Skill configures Workload Identity Federation so no downloadable service account keys are needed for authenticating your data lake orchestration pipelines.

What is the best way to isolate raw data in a BigQuery data lake?▼

The best way to isolate raw data in a BigQuery data lake is using layered datasets with a one-way data flow. This Skill sets up raw, clean, marts, and archive datasets to keep source data isolated from downstream transformations.

How do authorized views provide read-only access to BigQuery marts?▼

Authorized views provide read-only access to BigQuery marts by querying underlying raw and clean datasets on the agent's behalf. This Skill configures authorized views to allow downstream reading without exposing write permissions to the base tables.

How do I add audit logging and budget alerts to a BigQuery data lake?▼

To add audit logging and budget alerts to a BigQuery data lake, configure cloud-security monitoring and a billing budget guardrail. This Skill sets up audit logs and a budget alert to monitor activity and control costs.

Can I deploy an empty BigQuery data lake using Terraform?▼

Yes, you can deploy an empty BigQuery data lake using Terraform. This Skill offers a Terraform-driven Path B for reproducible deployment of your secure data lake, applying the SMB Data Lake Hardening Standard.

Related Skills

Explore More Data & Analytics Skills→
oborchersoborchers
28

multi-account-from-day-one

Guide multi-account cloud infrastructure setup across AWS, GCP, and Azure.

Community
Advanced
stahurastahura
19

json-no-code-connector

Ingest REST/JSON API data into Domo datasets without writing code.

Community
Intermediate
AgentientAgentient
2

cicd-patterns

Automate CI/CD pattern setup for Google Cloud Platform environments.

Official
Advanced
pluginagentmarketplacepluginagentmarketplace
1

devops-cloud

Automate cloud infrastructure provisioning and deployment with Terraform and Kubernetes.

Community
Advanced