VMs in project web-applications need BigQuery dataset access in project crm-databases. Following best practices, how should you grant access between projects?

The correct approach is to grant the BigQuery Data Viewer role to the service account or users within the web-applications project that require access to the BigQuery dataset in crm-databases. This follows the principle of least privilege, giving only the necessary permissions. The crm-databases project itself doesn't need roles granted to it; rather, the entities within web-applications need permissions on resources in crm-databases. Granting project owner to web-applications on crm-databases is overly permissive and violates least privilege. Granting project owner to both projects is also overly permissive. Granting project owner to crm-databases and web-applications roles/bigquery.dataViewer is incorrect because web-applications is a project, not an identity that can be granted a role on another project. Permissions are granted to identities (users, service accounts, groups) on resources.