Error: BigQuery User Permissions: Failed to Check Create Table Permission

Issue

BigQuery destination setup tests fail with the following error:

BigQuery User Permissions: Failed to check Create table permission : BigQuery job with id JobId{project=<project_id>, job=fivetran_bq_job_<job_id>, location=<location>} failed, Error: Cloud KMS Error: projects/<kms_project>/locations/<location>/keyRings/<key_ring>/cryptoKeys/<key_name>/cryptoKeyVersions/<version> is not enabled, current state is: DESTROY_SCHEDULED.

The error occurs even though the Fivetran service account has been granted the BigQuery User role. The destination may also show a Reconnect warehouse alert.

Environment

Destination: BigQuery

Resolution

To resolve this issue, ask your Google Cloud or security administrator to fix the customer-managed encryption key (CMEK) configuration:

1. Choose one of the following options:
   • If the key version is still within its scheduled destruction period, restore and enable it. This option preserves access to data encrypted with the key version:

   gcloud kms keys versions restore <version> --key=<key_name> --keyring=<key_ring> --location=<location> --project=<kms_project>
   gcloud kms keys versions enable <version> --key=<key_name> --keyring=<key_ring> --location=<location> --project=<kms_project>
   

   • If the key version is being intentionally retired, update the dataset or project-level default CMEK to use an enabled key. Then, re-encrypt any existing tables that reference the old key version.
2. Ensure that the BigQuery service agent, bq-<project_number>@bigquery-encryption.iam.gserviceaccount.com, has the roles/cloudkms.cryptoKeyEncrypterDecrypter role for the key.
3. Confirm that the key is in the same location as the dataset.
4. Once the key is enabled or the dataset references a valid key, re-run the destination setup tests in Fivetran.

After the scheduled destruction date, the key version and any data encrypted with it are permanently unrecoverable. Contact your Google Cloud team promptly.

Cause

This issue occurs when a BigQuery dataset or project uses a CMEK whose key version is scheduled for destruction. Cloud KMS disables the key version during the scheduled destruction period.

During the Check Permissions setup test, Fivetran submits a BigQuery job that creates a temporary table in the destination dataset. BigQuery cannot encrypt the table with the disabled key, so the test fails. Granting the BigQuery User role does not resolve the error because the CMEK configuration, rather than the Fivetran service account permissions, causes the failure.

This issue typically occurs after key rotation when the previous key version is scheduled for destruction while the dataset or existing tables still reference it.