You need to share BigQuery tables from a dataset encrypted with a customer-managed encryption key (CMEK) with a partner that has no access to your CMEK. What should you do?

The correct approach is to copy the tables to a dataset that does not use CMEK and then publish that dataset via an Analytics Hub listing. This is because CMEK-encrypted data requires the key for decryption, and sharing the key directly (option 1) is a security risk and often not feasible with external partners. Analytics Hub is designed for secure data sharing with external organizations, but it relies on the underlying dataset's accessibility. By removing the CMEK encryption, the data becomes accessible to the partner through Analytics Hub without compromising your key. Exporting to Parquet files in Cloud Storage (option 2) is a viable method for data transfer, but it's a manual process and doesn't leverage BigQuery's native sharing capabilities like Analytics Hub, which is designed for ongoing data exchange. Creating an authorized view (option 4) does not solve the CMEK access problem; the underlying tables still require the CMEK for decryption, and the view itself cannot embed or grant access to the CMEK.