BigQuery datasets are in multiple projects but all queries must be billed to a single project. Data projects should not incur query costs and users must be able to query but not modify data. How should you configure group roles?

The BigQuery Job User role (roles/bigquery.jobUser) on the billing project allows users to run jobs, including queries, and specifies that this project will incur the associated costs. The BigQuery Data Viewer role (roles/bigquery.dataViewer) on the data projects grants read-only access to datasets and tables, fulfilling the requirement that users can query but not modify data. This combination ensures query costs are centralized to the billing project and data projects remain cost-free for queries, while maintaining data integrity. Incorrect options: BigQuery User (roles/bigquery.user) includes permissions to create datasets, which violates the "not modify data" requirement. Granting BigQuery DataViewer on the billing project would not allow users to run queries. Granting BigQuery JobUser on data projects would incorrectly attribute billing to the data projects.