You are configuring service accounts for an application that spans multiple projects.

[Reference: https://cloud.google.com/blog/products/gcp/best-practices-for-working-with-google-cloud-audit- logging, bigquery.dataViewer role provides permissions to read the datasets metadata and list tables in the dataset as well as Read data and metadata from the datasets tables. This is exactly what we need to fulfil this requirement and follows the least privilege principle., Ref: https://cloud.google.com/iam/docs/understanding-roles#bigquery-roles, , ]