Bind a runner to a service account

Restrict a Soda Runner to a single service account so it can only access the data sources and datasets that account is explicitly permitted to use.

Preview feature. Runner–service account binding and runnerless data source creation are in private preview.

Contact us at [e-mail] to enable it in your organization.

By default, a Soda Runner has organization-wide access: it can reach every data source in your organization. Binding a runner to a service account restricts the runner to only the global roles and resource permissions granted to that single account, so it can access only the data sources and datasets that account is explicitly permitted to use.

Use this when different teams share one Soda Cloud organization but must not access each other's data sources. The runner's reach is scoped only to what one service account can access, instead of the whole organization.

Default runner	Runner bound to a service account
Organization-wide access to all data sources	Access limited to what the bound service account is permitted to use
Acts with broad implicit reach	Assumes only the global roles assigned to that service account
No pre-setup required	Service account must exist before the runner is created

Prerequisites

• Opt in and enable this feature with our support team.
• You have the Manage organization settings permission.
• The service account you want to bind already exists. It must be created before you set up the runner.

Create a runner bound to a service account

When you create a runner, you now choose its access model:

1

Create the service account if you haven't yet

If you haven't already, create a service account for the team or workload this runner will serve.

2

Onboard a data source and select no runner as default runner

Begin creating a new data source. When prompted to select a default runner, select runner later on the dropdown menu:

3

Create a new runner

Navigate to the Runners page, then create a new runner and select bind to a service account:

4

Select the service account to bind

Choose the service account to bind. The runner will inherit that account's global roles and resource permissions, and nothing more.

5

Finish runner setup

Complete the runner deployment as usual. Once the runner connects, the bound service account will allow to finish setup.

Data sources without runners have significant limitations.

• Test connection disabled
• Dataset onboarding blocked
• Diagnostic warehouse functionality unavailable

Make sure that your data sources have a runner connected.

Permission requirements

Because a bound runner only assumes its service account's permissions, the account must be granted access explicitly, at three levels:

Level	Minimum role	Why
Global role	Permissions such as create datasets	Lets the account perform org-level actions the runner needs
Data source access	Viewer	Minimum required to access the data source
Dataset access	Editor	Required to generate contracts. A Viewer role is not sufficient for contract generation.

The Viewer role is enough to read a data source but not to generate contracts — that requires Editor at the dataset level. If contract generation fails for a bound runner, check the service account's dataset role first.