Question 1

Which GCP services does Ana support?

Accepted Answer

Any GCP API reachable via service account permissions. Common targets include BigQuery, Cloud Storage, Cloud Logging, Cloud Monitoring, Cloud Run, GKE, and Cloud Billing. Admins control access through IAM roles on the service account dedicated to TextQL.

Question 2

Is Workload Identity supported?

Accepted Answer

Yes. For cleaner security, configure the connector to use Workload Identity Federation instead of long-lived service account keys. This eliminates key storage risk and gives you full audit traceability through Cloud Audit Logs for every Ana API call.

Question 3

How are service account keys handled?

Accepted Answer

JSON key files are encrypted at rest in TextQL's credential vault and injected at the network layer by our egress proxy. Ana's Python sandbox never sees the raw JSON. We recommend rotating keys regularly or switching to Workload Identity for best practice.

Question 4

Can Ana write to GCP?

Accepted Answer

Yes if the IAM role allows it. By default we recommend read-only roles. For write operations like creating BigQuery tables or publishing to Pub/Sub, grant only the specific permissions needed. All writes appear in Cloud Audit Logs for full traceability.

Question 5

Does this replace the BigQuery warehouse connector?

Accepted Answer

No. TextQL's BigQuery warehouse connector is optimized for running SQL analytics. This API connector is for calling GCP services programmatically from Ana's sandbox. Many teams use both to get the best of SQL analytics and live API access.