dosubot[bot] commented on issue #36956:
URL: https://github.com/apache/superset/issues/36956#issuecomment-3720325217

   <!-- Greeting -->
   Hi @joeyJsonar! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the 
superset team.
   
   <!-- Answer -->
   This behavior is expected: Superset intentionally does not export sensitive 
credentials like Google BigQuery service account private keys for security 
reasons. When you export and import a BigQuery database connection, the 
exported file contains the connection configuration but omits encrypted fields 
(such as the service account key stored in `encrypted_extra`). As a result, 
after import, the connection appears in the UI but cannot connect or create 
datasets until you manually edit the database and re-upload the service account 
credentials.
   
   There is currently no built-in prompt to remind you to re-upload credentials 
after import; you must do this step manually to restore connectivity. This 
design ensures that private keys and other secrets are never inadvertently 
transferred between environments or exposed in exported files. For BigQuery and 
other databases that rely on sensitive credentials, always plan to re-supply 
those credentials after importing the connection into a new Superset instance.
   
   Relevant code references:
   - [Export logic 
(superset/commands/database/export.py)](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/commands/database/export.py#L37-L103)
   - [Import logic 
(superset/commands/database/importers/v1/utils.py)](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/commands/database/importers/v1/utils.py#L35-L93)
   - [Database model 
(superset/models/core.py)](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/models/core.py#L129-L1059)
   
   To restore a BigQuery connection after import: edit the imported database, 
upload the service account credentials, and save. The connection should then 
work as expected.
   
   
   <!-- Dosu Comment Footer -->
   *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
   
   ---
   <sup>How did I do? 
[Good](https://app.dosu.dev/response-feedback/c0198e2f-7213-4cef-862a-9e80255e4379?feedback_type=great_response)
 | 
[Irrelevant](https://app.dosu.dev/response-feedback/c0198e2f-7213-4cef-862a-9e80255e4379?feedback_type=irrelevant_answer)
 | 
[Incorrect](https://app.dosu.dev/response-feedback/c0198e2f-7213-4cef-862a-9e80255e4379?feedback_type=incorrect_sources)
 | 
[Verbose](https://app.dosu.dev/response-feedback/c0198e2f-7213-4cef-862a-9e80255e4379?feedback_type=too_verbose)
 | 
[Hallucination](https://app.dosu.dev/response-feedback/c0198e2f-7213-4cef-862a-9e80255e4379?feedback_type=hallucination)
 | [Report 
šŸ›](https://app.dosu.dev/response-feedback/c0198e2f-7213-4cef-862a-9e80255e4379?feedback_type=bug_report)
 | 
[Other](https://app.dosu.dev/response-feedback/c0198e2f-7213-4cef-862a-9e80255e4379?feedback_type=other)</sup>
   
   [![Chat with 
Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github)&nbsp;[![Open
 in 
Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=This%20behavior%20is%20expected%3A%20Superset%20intentionally%20does%20not%20export%20sensitive%20credentials%20like%20Google%20BigQuery%20service%20account%20private%20keys%20for%20security%20reasons.%20When%20you%20export%20and%20import%20a%20BigQuery%20database%20connection%2C%20the%20exported%20file%20contains%20the%20connection%20configuration%20but%20omits%20encrypted%20fields%20%28such%20as%20the%20service%20account%20key%20stored%20in%20%60encrypted_extra%60%29.%20As%20a%20result%2C%20after%20import%2C%20the%20connection%20appears%20in%20the%20UI%20but%20cannot%20connect%20or%20create%20datasets%20until%20you%20manually%20edit%20the%20database%20and%20re-upload%20the%20service%20account%20credentials.%0A%0AThere%20is%20currently%20no%20buil
 
t-in%20prompt%20to%20remind%20you%20to%20re-upload%20credentials%20after%20import%3B%20you%20must%20do%20this%20step%20manually%20to%20restore%20connectivity.%20This%20design%20ensures%20that%20private%20keys%20and%20other%20secrets%20are%20never%20inadvertently%20transferred%20between%20environments%20or%20exposed%20in%20exported%20files.%20For%20BigQuery%20and%20other%20databases%20that%20rely%20on%20sensitive%20credentials%2C%20always%20plan%20to%20re-supply%20those%20credentials%20after%20importing%20the%20connection%20into%20a%20new%20Superset%20instance.%0A%0ARelevant%20code%20references%3A%0A-%20%5BExport%20logic%20%28superset/commands/database/export.py%29%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/commands/database/export.py%23L37-L103%29%0A-%20%5BImport%20logic%20%28superset/commands/database/importers/v1/utils.py%29%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/command
 
s/database/importers/v1/utils.py%23L35-L93%29%0A-%20%5BDatabase%20model%20%28superset/models/core.py%29%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/models/core.py%23L129-L1059%29%0A%0ATo%20restore%20a%20BigQuery%20connection%20after%20import%3A%20edit%20the%20imported%20database%2C%20upload%20the%20service%20account%20credentials%2C%20and%20save.%20The%20connection%20should%20then%20work%20as%20expected.)&nbsp;[![Join
 
Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share
 on 
X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/36956)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to