BigQueryIO.Read needs permissions to create datasets to be able to run queries

When using fromQuery, BigQueryIO creates a temp dataset to store the results of the query.

Therefore, Beam requires permissions to create datasets just to be able to run a query. In practice, this means that Beam requires the role bigQuery.User just to run queries, whereas if you use from (to read from a table), the role bigQuery.jobUser suffices.

BigQueryIO.Read should have an option to set an existing dataset  to write the temp results of
a query, so it would be enough with having the role bigQuery.jobUser.