You may have received a communication from Google regarding strict act-as mode enforcement in Dataform. Like some of our users, this may have raised questions or concerns. When we first received the email from Google, it was also a bit confusing for us, but we have since been able to clarify the situation. Below are answers to the most common questions.
What’s happening?
The update concerns the enforcement of strict act-as mode. When strict act-as mode is enabled, workflows can no longer be executed directly using the Dataform default service account. Instead, a custom service account is required. The default Dataform service account will still operate, but it will impersonate the custom service account. This mechanism is known as service account impersonation.
Read more about service account impersonation
What’s the main benefit of this change?
The main benefit is the clear separation of responsibilities between two service accounts:
- One service account dedicated to Dataform orchestration
- One service account dedicated to BigQuery execution
If one of these accounts is compromised, the impact is limited to a single service. This separation also improves auditability and traceability, making it easier to understand which service performed which action.
What’s the impact?
The impact should be limited, but you may notice the following changes:
- Repositories not connected to Git will no longer be able to run release configurations automatically.
- New log warning will appear when an act-as (impersonation) action occurs.
- Two service accounts will now be involved in the execution of Dataform actions instead of one.
When will Act-as be enforced?
- January 19, 2026: Act-as check will be enforced for all newly created repositories.
- Between April 29 and July 31, 2026: strict act-as mode will be gradually enforced for existing repositories.
Why should I care about it?
We strongly encourage GA4Dataform users and Dataform users in general to learn more about Cloud Platform management best practices. Even though Dataform can be configured in just a few clicks and with limited technical knowledge, it remains important to understand more advanced concepts to avoid potential issues, whether related to security or costs for example. Read more about Google Cloud Platform or Dataform.
What should I do as a GA4Dataform user?
GA4Dataform Core and Premium users will have very little to do. Our installer will be updated to handle these changes automatically:
- Appropriate permissions will be applied following best practices
- A new custom service account will be created
For new GA4Dataform users, any repository created using the installer will be ready to operate with Strict act-as mode.
For existing GA4Dataform users, the installer can be used to update current repositories and make them compatible with Strict act-as mode.
How will GA4Dataform installer be updated exactly?
Coming as soon as our installer has been updated
As always feel free to reach out our support if you have any questions
