Cloudflare D1 and BigQuery

How to connect

Cloudflare D1 and BigQuery are connected through Cloudflare or Google OAuth consent instead of a connection string. You don't need to create a read-only user, and Cloudflare Tunnel is not used.

1. 1

   Under "Connections" in the console, click "Add connection", then choose "Internet" as the connection route and "Cloudflare D1" or "BigQuery" under "Connect with".

2. 2

   Click "Connect Cloudflare" or "Connect Google" and approve the read permissions on the screen that opens.

3. 3

   Pick a D1 database (Cloudflare D1) or a Google Cloud project (BigQuery) from the list and register it. At registration, Scandock confirms that it can read and that writing fails.

Cloudflare D1

• Permissions requested: Read access to D1, account analytics and account settings only. Cloudflare itself rejects writes.
• What can be read: Permissions are granted per account rather than per database, so every D1 database in the authorized account becomes readable. Scandock monitors and investigates only the database you register.
• What the AI reads: Table, column and index definitions (sqlite_master and pragmas), results of read queries, and per-query statistics from Cloudflare's GraphQL Analytics (count, duration, rows read and rows written).
• Revoking access: You can revoke the authorization at any time from your profile in the Cloudflare dashboard.

BigQuery

• Permissions requested: Read access to BigQuery only. Google itself rejects writes.
• What can be read: The data the authorizing Google account can see. To narrow that, authorize with a Google account dedicated to monitoring that has only permission to run jobs in the project (BigQuery Job User) and to read the datasets you want monitored (BigQuery Data Viewer).
• What the AI reads: Table and column definitions from each dataset's INFORMATION_SCHEMA, row counts, sizes and last-modified times of tables, results of read queries, and job history (cost, failures, duration, slots) from the region-level INFORMATION_SCHEMA.JOBS.
• Revoking access: You can revoke the authorization at any time from "Third-party apps & services" in your Google Account.

BigQuery costs

Monitoring and investigation queries run in the project you choose, and BigQuery charges for the data they read go to that project. These charges are billed by Google Cloud, separately from Scandock's fees.

Data billed per query is capped at 1 GiB. BigQuery refuses to run queries that would exceed it, and does not charge for them.

Differences from connection-string databases

• SQL actions: There is no admin connection, so SQL actions that write are not available (notifications and other actions are).
• AI queries: Only single statements run: SELECT, EXPLAIN and WITH on Cloudflare D1, and SELECT and WITH on BigQuery (WITH only when its body is a SELECT).