dosubot[bot] commented on issue #36956: URL: https://github.com/apache/superset/issues/36956#issuecomment-3720325217
<!-- Greeting --> Hi @joeyJsonar! I'm [Dosu](https://go.dosu.dev/dosubot) and Iām helping the superset team. <!-- Answer --> This behavior is expected: Superset intentionally does not export sensitive credentials like Google BigQuery service account private keys for security reasons. When you export and import a BigQuery database connection, the exported file contains the connection configuration but omits encrypted fields (such as the service account key stored in `encrypted_extra`). As a result, after import, the connection appears in the UI but cannot connect or create datasets until you manually edit the database and re-upload the service account credentials. There is currently no built-in prompt to remind you to re-upload credentials after import; you must do this step manually to restore connectivity. This design ensures that private keys and other secrets are never inadvertently transferred between environments or exposed in exported files. For BigQuery and other databases that rely on sensitive credentials, always plan to re-supply those credentials after importing the connection into a new Superset instance. Relevant code references: - [Export logic (superset/commands/database/export.py)](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/commands/database/export.py#L37-L103) - [Import logic (superset/commands/database/importers/v1/utils.py)](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/commands/database/importers/v1/utils.py#L35-L93) - [Database model (superset/models/core.py)](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/models/core.py#L129-L1059) To restore a BigQuery connection after import: edit the imported database, upload the service account credentials, and save. The connection should then work as expected. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/c0198e2f-7213-4cef-862a-9e80255e4379?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/c0198e2f-7213-4cef-862a-9e80255e4379?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/c0198e2f-7213-4cef-862a-9e80255e4379?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/c0198e2f-7213-4cef-862a-9e80255e4379?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/c0198e2f-7213-4cef-862a-9e80255e4379?feedback_type=hallucination) | [Report š](https://app.dosu.dev/response-feedback/c0198e2f-7213-4cef-862a-9e80255e4379?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/c0198e2f-7213-4cef-862a-9e80255e4379?feedback_type=other)</sup> [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=This%20behavior%20is%20expected%3A%20Superset%20intentionally%20does%20not%20export%20sensitive%20credentials%20like%20Google%20BigQuery%20service%20account%20private%20keys%20for%20security%20reasons.%20When%20you%20export%20and%20import%20a%20BigQuery%20database%20connection%2C%20the%20exported%20file%20contains%20the%20connection%20configuration%20but%20omits%20encrypted%20fields%20%28such%20as%20the%20service%20account%20key%20stored%20in%20%60encrypted_extra%60%29.%20As%20a%20result%2C%20after%20import%2C%20the%20connection%20appears%20in%20the%20UI%20but%20cannot%20connect%20or%20create%20datasets%20until%20you%20manually%20edit%20the%20database%20and%20re-upload%20the%20service%20account%20credentials.%0A%0AThere%20is%20currently%20no%20buil t-in%20prompt%20to%20remind%20you%20to%20re-upload%20credentials%20after%20import%3B%20you%20must%20do%20this%20step%20manually%20to%20restore%20connectivity.%20This%20design%20ensures%20that%20private%20keys%20and%20other%20secrets%20are%20never%20inadvertently%20transferred%20between%20environments%20or%20exposed%20in%20exported%20files.%20For%20BigQuery%20and%20other%20databases%20that%20rely%20on%20sensitive%20credentials%2C%20always%20plan%20to%20re-supply%20those%20credentials%20after%20importing%20the%20connection%20into%20a%20new%20Superset%20instance.%0A%0ARelevant%20code%20references%3A%0A-%20%5BExport%20logic%20%28superset/commands/database/export.py%29%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/commands/database/export.py%23L37-L103%29%0A-%20%5BImport%20logic%20%28superset/commands/database/importers/v1/utils.py%29%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/command s/database/importers/v1/utils.py%23L35-L93%29%0A-%20%5BDatabase%20model%20%28superset/models/core.py%29%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/models/core.py%23L129-L1059%29%0A%0ATo%20restore%20a%20BigQuery%20connection%20after%20import%3A%20edit%20the%20imported%20database%2C%20upload%20the%20service%20account%20credentials%2C%20and%20save.%20The%20connection%20should%20then%20work%20as%20expected.) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/36956) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
